IBM API Connect versions from 12.1.0.0 through 12.1.1.2 contain a broken object‑level authorization flaw that allows a remote, authenticated attacker to modify application API subscriptions. Because the attacker can alter subscription details, they can change usage limits, billing structures, and potentially gain unauthorized access to protected API traffic, impacting data integrity and service availability.

This vulnerability affects IBM API Connect version 12.1.0.0 through 12.1.1.2. Users of IBM API Connect should verify whether they run any of these affected builds.

The CVSS score of 7.1 places this vulnerability in the high‑severity range. EPSS information is not available, so the likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog, indicating no documented widespread exploitation yet. However, the attack requires a valid authenticated session, meaning privileged users or compromised credentials are necessary. Once authenticated, the attacker can adjust subscription settings, representing a significant risk to the configuration and billing structure of the API environment.