IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection flaw because input values are not properly neutralised before being used in database queries. This weakness allows an authenticated attacker to read, insert, update, or delete records in the back‑end database, resulting in loss of confidentiality and integrity of stored data. The flaw is classified as CWE‑89, an injection vulnerability.

The affected products are IBM API Connect in the 10.x and 12.x series. Specifically, versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 are impacted. Operators using these releases should verify which exact build they are running and determine whether an update is required.

The CVSS score of 7.6 indicates a high severity for confidentiality, integrity, and availability. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the estimated likelihood of exploitation cannot be quantified from public data. However, because the condition requires only an authenticated session but does not rely on privileged access or advanced techniques, the attack vector is likely to be achievable by compromised or legitimate users with sufficient permissions. The impact to the database is substantial, and the vulnerability can be leveraged to exfiltrate sensitive data or manipulate backend records.