IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a broken object‑level authorization control that allows a remote authenticated attacker to read keystore objects, exposing sensitive credential and configuration data to the attacker. The vulnerability is a direct result of missing access checks on keystore objects, leading to confidentiality compromise.

The affected products are IBM API Connect versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. Any installation of these releases that has active keystore objects and user authentication enabled is potentially vulnerable.

The CVSS score of 8.8 indicates a high impact vulnerability with a medium to high exploitation likelihood. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to exploit this flaw, so the attack vector is a remote authenticated user who can manipulate or search for keystore objects and obtain their contents when authorization checks fail.