IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference that permits a remote authenticated attacker to delete or overwrite arbitrary control‑plane assets. This flaw compromises the integrity of the platform by enabling the attacker to remove or modify configuration and operational data, potentially disrupting services and exposing sensitive information. The weakness, identified as CWE‑639, does not directly grant confidentiality exposure but severely undermines the platform’s reliability and trustworthiness.

IBM API Connect 12.1.0.0 and 12.1.1.2 are affected. The product name is IBM:API Connect and the affected versions are explicitly listed in the CNA data as 12.1.0.0 and 12.1.1.2.

The CVSS score of 8.1 places the vulnerability in the high severity range, indicating significant impact if exploited. The EPSS score is not available, so the exact probability of real‑world exploitation is unknown, but the absence of a KEV listing suggests no widespread exploitation has been documented. The likely attack vector is remote, requiring legitimate authentication to the control plane; an attacker with valid credentials can supply a malicious object reference to delete or overwrite arbitrary assets, thereby degrading or disabling the platform.