IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference that allows a remote authenticated attacker to read data that should be protected. The flaw arises when object identifiers are not properly validated, enabling the attacker to request objects that are outside their authorized scope and obtain sensitive information. This vulnerability compromises the confidentiality of data stored or served by API Connect.

IBM API Connect v12.1.0.0 to v12.1.1.2 are affected. No other IBM components are mentioned in the advisory.

The CVSS v3.1 score of 7.7 indicates high severity, while the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid authentication, so an attacker must already have legitimate credentials or find a way to obtain them, which somewhat limits the likelihood of widespread exploitation. Nonetheless, an authenticated compromise can lead to unauthorized disclosure of sensitive information, warranting prompt remediation.