IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw. An attacker who authenticates to the platform can craft requests that force the server to connect to arbitrary URLs, enabling them to read data from internal resources. This vulnerability can be used for sensitive information disclosure and is categorized as CWE‑918.

The vulnerability affects IBM API Connect versions 12.1.0.0 up to 12.1.1.2. The affected product is IBM API Connect and the recommendation is to upgrade to 12.1.1.3 or later. No other product versions are mentioned.

The CVSS base score for the flaw is 8.5, reflecting a high severity. The EPSS score is not available, so the current probability of exploitation is unknown. It is not listed in CISA's KEV catalog. Attack requires a remotely authenticated user; the attacker must obtain valid credentials on the API Connect instance. Once authenticated, the attacker can trigger outbound requests that access internal services, potentially exposing sensitive data.