IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw. A remote authenticated attacker can bypass server checks, causing the application to contact internal resources and obtain information that should be blocked. The flaw can lead to unauthorized disclosure of sensitive data. The underlying weakness is identified as CWE-918.

The affected product is IBM API Connect. Vulnerable releases include all 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. These versions are commonly deployed in API‑management environments. No firmware or other components are listed as impacted.

The CVSS v3.1 score is 8.5, indicating high severity. EPSS data is not available, so current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. Attacks require the attacker to be authenticated to the API Connect instance; once authenticated, the attacker can craft requests that cause the server to resolve and access otherwise blocked destinations. An attacker could therefore read internal data or trigger unauthorized operations.