IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote attacker to perform LDAP injection. The input used in directory lookups is not properly neutralized, enabling the attacker to force queries that return additional data from the connected LDAP directory. This results in the disclosure of sensitive information and is classified under CWE‑90.

The affected product is IBM API Connect, specifically all releases from 10.0.8.0 to 10.0.8.12 and from 12.1.0.0 to 12.1.1.2. These versions can be identified by their corresponding CPE names for IBM:api_connect with the listed version ranges.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through remote submission of crafted LDAP queries, requiring the attacker to have network access to the API Connect instance. Once executed, it can read sensitive directory data but does not grant code execution or full system compromise.