IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain multiple vulnerabilities that allow a remote attacker to obtain sensitive information by sending crafted URLs to the system. The underlying weakness is improper validation of user‑supplied URLs, classified as CWE‑918. Based on the description, it is inferred that the flaw could lead to disclosure of internal configuration data, authentication tokens, or other confidential information that the gateway processes when resolving such URLs.

The affected product is IBM API Connect, specifically the 12.1.0.0 through 12.1.1.2 releases. These versions are used for building and managing API services within IBM Cloud Pak for Integration environments. Any instance running these releases is susceptible to the disclosed information‑disclosure issue.

The CVSS score of 5.8 indicates a medium severity level, and the EPSS score is not available, suggesting that there is no current evidence of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, over the network, where an attacker can supply a malicious URL to trigger the flaw. Based on the description, it is inferred that the flaw could enable extraction of sensitive data, so organizations running the affected releases should treat the issue as a moderate risk and proceed with remediation.