IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows a remote authenticated attacker to read information that belongs to other users. The issue arises because the system uses values supplied in the request URL as part of its authorization logic without sufficient verification, enabling access to data the attacker should not see. This weakness is categorized as CWE‑639, improper validation of authorizing information.

IBM’s API Connect product, particularly the 10.x series (10.0.8.0‑10.0.8.12) and the 12.x series (12.1.0.0‑12.1.1.2). These affected releases are deployed in enterprises that expose APIs for remote consumption.

The documented CVSS score is 5, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the system, but once authenticated they can supply manipulated URL parameters to bypass authorization checks and extract sensitive data belonging to other users. The exploit requires only remote access and valid credentials, making it relatively straightforward for privileged users or compromised accounts to exploit.