The vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 allows a remote authenticated attacker to gain unauthorized access to sensitive information. The issue arises from improper validation of user‑supplied URLs, enabling an attacker to supply crafted URLs that bypass normal security checks. This flaw is classified as CWE‑918, an improper validation of input that can lead to information exposure.

Affected products are IBM API Connect releases 12.1.0.0 and 12.1.1.2. The vulnerability exists in these versions as indicated by the known CPE strings for 12.1.0.0 and 12.1.1.2. All deployments running these specific releases are impacted, regardless of environment or configuration, until the fix is applied.

The CVSS score of 8.5 places this flaw in the high severity range, implying significant risk to confidentiality for authenticated users. EPSS data is not available, but the lack of a KEV listing does not diminish the potential for exploitation. The flaw requires that the attacker already be authenticated to the system, after which manipulation of URLs can expose privileged data. The attack vector is remote, as the vulnerability can be triggered over the network through standard API calls.