IBM API Connect 12.1.0.0 through 12.1.1.2 contains a vulnerability that allows a remote, authenticated attacker to modify tool configuration settings. By manipulating these settings, the attacker can disrupt service operation, resulting in a denial of service. The flaw is caused by improper authorization checks when trusting client supplied information, and is classified as CWE-862.

The affected product is IBM API Connect for versions 12.1.0.0 through 12.1.1.2. Users of these releases should be aware that the vulnerability exists until they upgrade to IBM API Connect 12.1.1.3 or newer, which includes the fix listed in IBM’s Fix Central.

The CVSS score of 7.1 indicates a medium severity risk while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires authenticated access, an attacker must have valid credentials; however, once credentials are obtained, the attacker can gain control over configuration and cause service interruption. The attack vector is remote.