A server‑side request forgery flaw allows an authenticated user to instruct the IBM API Connect server to request arbitrary URLs, potentially exposing sensitive data from internal services. The vulnerability is limited to authenticated attackers but can lead to disclosure of confidential information, making it a moderate severity risk with a CVSS score of 5.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected. The Vendor recommends upgrading to version 12.1.1.3 to mitigate the issue.

The flaw can be exploited by an attacker who has legitimate credentials to the platform. Once authenticated, the attacker crafts requests that trigger outbound calls. The current EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a moderate but non‑critical threat level pending further exploitation data.