IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object‑level authorization that allows a remote authenticated attacker to read sensitive information. The vulnerability is a case of improper authorization (CWE‑639) and can lead to disclosure of confidential data if an attacker compromises or obtains valid credentials. An attacker who can authenticate to the platform can potentially access or infer data that should be protected by resource‑level permissions.

The affected products are IBM API Connect from IBM, specifically the releases 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

The CVSS base score of 5 indicates a moderate impact, and the EPSS score is not available, suggesting limited publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate to the platform, which implies that credential compromise or weak passwords are prerequisites. The exploitation path therefore involves legitimate login followed by exploitation of the broken object‑level checks to read protected data.