IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper case‑sensitivity handling flaw that allows a remote attacker to bypass access controls and perform privileged administrative operations. The weakness, identified as CWE‑178, compromises both the confidentiality and integrity of the data managed by the API gateway, enabling attackers to retrieve or alter sensitive information without authorization.

Affected installations are IBM API Connect 10.0.8.x and 12.1.x, specifically the releases ending in .0 through .12 for the 10.0 branch and .0 through .2 for the 12.1 branch. These versions can be identified in standard inventory tools that report the product name and release number, without needing to reference raw CPE strings.

The vulnerability has a CVSS base score of 9.4, indicating a high‑risk severity. While no EPSS information is available, the remote attack vector and the nature of the flaw suggest that exploitation could be achieved by crafting requests that vary case sensitivity. The flaw is not currently listed in the CISA KEV catalog, but its severity and remote accessibility make it a high priority for remediation.