The flaw is a path‑parameter validation issue that allows an authenticated user to read data belonging to a different tenant. The underlying weakness is a classic path traversal (CWE‑22) caused by an insufficiently sanitized path value. Attackers can therefore exfiltrate confidential tenant information when they send a request with a crafted path segment.

All installations of IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. This includes the products listed in the vendor’s fix list: IBM API Connect v10.0.8.0, v10.0.8.12, v12.1.0.0 and v12.1.1.2.

The CVSS score of 8.5 indicates a high‑severity vulnerability that permits confidentiality compromise. The EPSS score is not available, so the exact exploitation probability is unknown, but the relational model suggests that any authenticated user can exploit the flaw. The vulnerability is not listed in CISA’s KEV catalog, which implies it may not currently have known publicly exploited instances. Still, the ability to read cross‑tenant data renders the risk significant, especially in multi‑tenant environments.