IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain improper input validation that allows a remote authenticated attacker to retrieve sensitive information by bypassing incomplete input checks. The vulnerability is an information disclosure flaw that compromises confidentiality and could reveal credentials, design data or other protected material. Attackers with valid authentication credentials are required to exploit the flaw, but once authenticated they can access data beyond what their role should allow.

The affected product is IBM API Connect. All installations of version 12.1.0.0 and 12.1.1.2 are vulnerable. Users running these versions should verify that they are not exposed to the vulnerability.

The CVSS score of 8.5 indicates a high severity. Because EPSS is not available, the current exploitation probability cannot be quantified but the lack of a KEV listing suggests no known large‑scale active exploitation. The vulnerability can be exploited by an authenticated attacker with any type of user role; therefore, a privileged account or a compromised account can be used to extract sensitive data. The lack of a public exploit reduces but does not eliminate the need for remediation.