IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from missing authentication for a critical function, which allows a remote attacker to read sensitive configuration information and perform unauthorized actions. The flaw directly compromises confidentiality and integrity by enabling an attacker to alter or inspect protected settings without valid credentials, and is classified as CWE-306.

The affected vendor is IBM and the product is API Connect. Vulnerable releases include 12.1.0.0 and 12.1.1.2.

The vulnerability has a CVSS score of 8.3, indicating a high level of risk. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker exploiting the unauthenticated endpoint to gain access, as no additional authentication is required for the critical function. This suggests that exposed services could be targeted without initial credentials, making exploitation relatively straightforward for an attacker who can reach the interface.