The vulnerability stems from broken object‑level authorization logic, which allows an attacker who has authenticated to the system to request and receive sensitive data that should be protected. This flaw results in unauthorized reading of information that may include configuration details, user data, or other confidential assets. The weakness is identified as a CWE‑639 type authorization bypass through a user‑controlled key, underscoring that access controls can be subverted when the system trusts clients to specify resource identifiers.

IBM API Connect products are impacted. Specifically, any deployment of version 10.0.8.0 through 10.0.8.12 as well as 12.1.0.0 through 12.1.1.2 is vulnerable. The fixed releases that address this issue are 10.0.8.13 for the 10.x line and 12.1.1.3 for the 12.x line.

The CVSS score of 6.5 indicates a moderate severity level. Exploitation requires the attacker to have valid credentials, meaning the vulnerability can be abused by any authenticated user. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while a known exploitation pathway exists, large‑scale exploitation has not yet been observed. Nevertheless, because the flaw permits sensitive data disclosure, organizations should treat it as a critical remediation priority.