The flaw is improper neutralization of argument delimiters that lets an authenticated user craft requests containing delimiter characters that are misunderstood by the application. This allows a remote attacker, once authenticated in IBM API Connect, to read and alter portal data belonging to other tenants. The consequence is a breach of confidentiality, integrity, and potentially availability of tenant data. The weakness is identified as CWE‑88: Improper Neutralization of Argument Delimiters.

The affected versions are IBM API Connect 10.0.8.0 through 10.0.8.12 and IBM API Connect 12.1.0.0 through 12.1.1.2, which includes the 12.1.0.0 to 12.1.1.2 release line. The vulnerability is present in the controller and connector components that manage portal data for multi‑tenant environments. Organizations deploying any of these releases should review whether they are using the affected build.

The CVSS score of 9.9 reflects a high‑severity flaw that could be exploited remotely by authenticated users. EPSS is not available for this vulnerability, and it is not listed in the CISA KEV catalog, but the serious score indicates that if exploited, the attacker could gain unauthorized access to other tenants’ data. The attack requires legitimate credentials within the API Connect environment, so it does not expose unauthenticated users. Because the flaw is tied to argument handling, the attack surface is limited to consumers who have access to the portal, but once compromised the attacker can alter portal data across tenants.