IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a flaw that allows an authenticated user to learn the names of other organizations. An authentication token issued for a limited purpose is accepted where it should not be, revealing restricted information that should not be disclosed to that user. The vulnerability represents an information disclosure issue caused by incorrect authorization checks.

The affected vendor is IBM, the product is IBM API Connect. All releases from 10.0.8.0 to 10.0.8.12 and from 12.1.0.0 to 12.1.1.2 are vulnerable and require patching before they can be considered secure.

The CVSS score of 4.3 indicates a moderate severity, yet the vulnerability requires an authenticated session to be exploited, so the scope is limited to users who have legitimate access. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting there are no confirmed exploits in the wild. The likely attack vector is an authenticated API call that presents a restricted token, so the risk exists only if an attacker can obtain any authentic user credentials. Patches address the flaw by enforcing correct token validation and authorization rules.