The vulnerability is an object‑level authorization flaw that allows a remote authenticated attacker to read data that the user should not be able to view. Because the controls that should limit access to objects are bypassed, an attacker can disclose confidential information by making legitimate API calls. This weakness is classified as CWE‑639, representing an authorization bypass through user‑controlled keys.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected, as listed by the vendor CNA. The current advisory recommends upgrading to version 12.1.1.3 or 10.0.8.13 to remediate the issue.

The CVSS score of 6.3 reflects a moderate severity with impact on confidentiality. The EPSS score is not available, but the vulnerability requires authenticated access, which may limit the pool of potential attackers. The issue is not listed in the CISA KEV catalog, and no known public exploits have been reported. Nonetheless, an authenticated user could gain access to privileged data, potentially affecting regulatory compliance and trust in the API service.