IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote authenticated attacker to read sensitive data that should be protected. The vulnerability arises because authorization checks depend on values supplied by the client, letting the attacker bypass intended access controls and obtain information that belongs to other users. This flaw is classified as CWE‑639: authorization bypass through user controlled data.

The affected products are IBM API Connect. Versions from 10.0.8.0 up to and including 10.0.8.12, as well as from 12.1.0.0 up to and including 12.1.1.2, are impacted. The vendor recommends upgrading to 10.0.8.13 or the 12.1.1.3 release to remediate the issue.

Based on the description, the vulnerability is exploitable by an authenticated user with network access to the API Connect instance. The attacker could supply crafted authorization data to access restricted resources. The CVSS score of 7.7 indicates high severity and the lack of a published exploit and the fact that the EPSS score is not available suggests a moderate but uncertain probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no confirmed exploitation yet.