IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by a flaw that allows a remote authenticated attacker to obtain sensitive data because the system fails to properly validate authorization when user‑controlled keys are used. The weakness is a classic example of an authorization bypass (CWE‑639) and results in a breach of confidentiality, potentially exposing internal credential information or other protected resources. The vulnerability does not provide a local privilege escalation or denial of service; its impact is limited to information disclosure if the attacker can gain authenticated access to the system.

The affected products are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, which are widely used for managing RESTful APIs in enterprise environments. The vulnerability applies to any deployment of these IBM products where user‑controlled keys are permitted for authorization checks, regardless of whether the API is exposed externally or internally.

The CVSS score of 8.5 categorizes this flaw as high severity, and the vendor has recommended immediate remediation. Though EPSS data is not available, the nature of the flaw—remote authenticated access to sensitive data—makes exploitation likely in scenarios where the attacker gains credential access. The vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of exploitation in the wild, but the potential for data exposure warrants urgency. Attackers would need valid credentials to reach the affected endpoints, but once authenticated they can craft requests that use manipulated keys to retrieve information beyond their normal scope.