IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization flaw that allows a remote authenticated attacker to read sensitive information. The vulnerability arises when the system trusts user‑controlled keys as a source of authorization, leading to an improper authorization check. This flaw can result in the disclosure of confidential data.

Affected are IBM's API Connect product, specifically the versions listed as 12.1.0.0 to 12.1.1.2. The CPE identifiers confirm that both 12.1.0.0 and 12.1.1.2 installations are vulnerable. Users running these releases should consider the version numbers above as at risk.

The CVSS score of 8.5 indicates a high severity rating, raising confidentiality concerns. Although the EPSS score is not available, the lack of KEV listing suggests no publicly known exploits yet, but the vulnerability still carries strong risk if valid credentials exist. The attack vector is remote but requires authenticated access, meaning an attacker who circumvents authentication or has legitimate credentials can exploit the flaw by using user‑controlled keys. Preemptive patches or mitigations are recommended.