This vulnerability is caused by missing object‑level authorization checks in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. An attacker with valid credentials can exploit the flaw to read data that should be restricted to higher‑privilege users. The weakness is classified as CWE‑639 and results in the disclosure of sensitive information, compromising confidentiality while not affecting integrity or availability.

Affected systems are IBM API Connect 10.0.8.x through 10.0.8.12 and 12.1.0.x through 12.1.1.2. The product, IBM:API Connect, includes the listed CPE strings for these releases.

The CVSS score of 7.7 indicates high severity, and exploitation requires the attacker to be authenticated to the API Connect instance. No EPSS score is available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA KEV. The official remediation is to upgrade to 10.0.8.13 or 12.1.1.3. Until the patch is applied, an attacker with valid credentials may retrieve protected data by sending API requests that bypass the missing authorization checks.