IBM API Connect 12.1.0.0 through 12.1.1.2 contain a flaw in input validation (CWE-918) that occurs when service definitions are imported. A remote attacker who is authenticated with appropriate credentials can supply potentially malicious input, causing the server to read and return content that it should not have access to, thereby exposing sensitive data.

The vulnerability affects IBM API Connect version 12.1.0.0 up through 12.1.1.2. These versions are listed as vulnerable in the affected product identifiers.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires remote authenticated access, which is the likely attack vector; an attacker with legitimate credentials could exploit the lack of proper validation to retrieve unauthorized data.