The vulnerability is a broken access control flaw that allows a remote attacker to obtain sensitive information, including credentials, from IBM App Connect Enterprise. The flaw permits unauthorized disclosure of protected data, compromising the confidentiality of sensitive credentials and potentially enabling further exploitation. The impact is loss of confidentiality for any data accessed through the vulnerable application, with a CVSS score of 7.5 indicating high severity.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2, including all builds between those releases, are impacted. Users must upgrade to fix pack 13.0.9.0 (APAR IT50196) to remediate the flaw.

The CVSS score of 7.5 highlights a high risk. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploits yet. Based on the description, the attack vector is likely remote over network interfaces accessed by the application, and an attacker would need only network access to trigger the access control bypass. The flaw can be exploited without local privilege, making it potentially accessible to any remote attacker.