IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows an authenticated attacker to access sensitive data due to improper authorization checks. The vulnerability can expose configuration details, credentials, or other privileged information that should be protected by role‑based access controls.

The affected products are IBM API Connect versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. Administrators should verify that their installations match these version ranges and determine whether they are running a vulnerable release.

The CVSS score of 7.7 indicates high severity, and the vulnerability is not listed in CISA KEV, though EPSS data is not available. An attacker requires valid credentials to the API Connect platform, after which the flawed authorization logic permits reading of data beyond the attacker’s scope. The lack of an EPSS score suggests no publicly known exploits yet, but the high impact justifies immediate action. The likely attack vector is authenticated API calls made with compromised or weak credentials, leading to data disclosure.