IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have an improper authorization flaw that can allow a remote authenticated attacker to obtain sensitive information. The vulnerability arises when the system fails to enforce proper access controls, letting the attacker read protected data that they should not have permission to access.

The affected product is IBM API Connect, with vulnerable releases 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2.

The CVSS score of 7.7 classifies this as a high severity issue, and the vulnerability is exploitable remotely by any user who has authenticated to the API Connect instance. Because the flaw stems from insufficient authorization checks rather than a code injection or buffer overflow, there is no evidence of publicly available remote exploits at this time, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is not available, so the probability of exploitation cannot be quantified; however, the requirement for authentication makes the attack feasible within environments where privileged credentials are compromised or weak.