IBM API Connect 12.1.0.0 through 12.1.1.2 can allow an authenticated privileged attacker to cause the system to send malicious requests to other services via server‑side request forgery. This enables enumeration of internal network resources or can be used to launch additional attacks. The weakness originates from the handling of request destinations without proper validation (CWE‑918).

IBM API Connect versions 12.1.0.0 and 12.1.1.2 are affected. All installations of these releases should be identified and assessed for use of privileged accounts that could exploit the SSRF flaw.

The CVSS score of 3.8 reflects a moderate impact. Exploitation requires an authenticated user with privileged rights, and the vulnerability does not provide remote code execution or elevation. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Because the flaw allows attackers to forge internal requests, an attacker with sufficient privileges could enumerate network services or serve as a pivot for further attacks. The risk remains moderate but notable in environments where privileged credentials are widely distributed.