IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 implement object‑level authorization checks that are insufficient; a remote authenticated attacker can exploit this weakness to read data belonging to other tenants, resulting in a confidentiality breach. The vulnerability is an example of Unauthorized Access (CWE‑639) and the CVSS score of 7.7 indicates a high severity.

The affected products are IBM API Connect for vendors IBM. The specific releases impacted include IBM API Connect 10.0.8.0, 10.0.8.1 through 10.0.8.12, and IBM API Connect 12.1.0.0, 12.1.1.0 through 12.1.1.2. All other releases are considered unaffected unless a future advisory expands the scope.

The high CVSS score combined with the lack of available EPSS data suggests a moderate to high likelihood that motivated actors with legitimate tenant credentials could leverage the flaw. The vulnerability requires prior authenticated access within a tenant but does not demand privileged system rights; once logged in, an attacker may craft requests that bypass tenant isolation and retrieve sensitive information belonging to other tenants. The flaw is not listed in CISA’s KEV catalog, so there is no public evidence of widespread exploitation yet, but the potential for cross‑tenant data exposure warrants prompt remediation.