IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object‑level authorization flaw, allowing a remote authenticated attacker to view sensitive information that should be restricted. This vulnerability is classified as CWE-639 and can expose confidential data if exploited. The flaw is a lack of proper permission checks on individual objects, giving users access beyond their intended scope.

The affected product is IBM API Connect for the following releases: 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2; the vendor recommends upgrading to 10.0.8.13 or 12.1.1.3, respectively.

The CVSS score of 8.5 indicates high severity, and the EPSS score is not available, suggesting uncertain current exploitation probability. Because the weakness requires authentication, the attacker must first obtain valid credentials. The vulnerability is not listed in CISA KEV, but the lack of object‑level access controls means any authenticated attacker can read data they should not see. Timely patching is therefore recommended to prevent potential data leaks.