IBM API Connect 12.1.0.0 through 12.1.1.2 suffer from a missing authorization check that allows a remote attacker to create, modify, or delete tenants. This privilege escalation flaw (CWE‑862) undermines tenant isolation, permitting an attacker to add privileged tenants, reconfigure existing ones, or remove them entirely, potentially exposing sensitive data or disrupting services for other tenants.

All on‑premises deployments of IBM API Connect version 12.1.0.0 to 12.1.1.2 are affected, including releases v12.1.0.0 through v12.1.1.2. Any environment using these versions must be remediated to v12.1.1.3 or later.

The CVSS score of 9.8 indicates critical severity, but no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote network access to the API gateway and the attacker can call the tenant‑management endpoints without proper authorization. The likely attack vector is remote, leveraging the exposed API endpoints to perform privileged tenant operations.