IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object‑level authorization flaw that could allow a remote authenticated attacker to retrieve sensitive data. The flaw arises when the system fails to enforce proper access controls on individual objects, permitting privileged reads that bypass intended restrictions.

Affected systems are IBM API Connect deployments running version 10.0.8.0 to 10.0.8.12 and version 12.1.0.0 to 12.1.1.2. The vulnerability impacts clients that consume APIs exposed by the product, and any environment where these versions are deployed, whether on‑premises or in the cloud.

The CVSS base score of 7.7 indicates a high severity vulnerability, but the EPSS value is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication, an attacker must first obtain valid credentials; once authenticated, the attacker can access protected data by manipulating or prefixing object identifiers. The lack of known exploitation incidents does not preclude abuse, and the high score suggests that remediation should be prioritized.