The vulnerability is a server‑side request forgery (SSRF) that enables an authenticated attacker to send unauthorized requests from the IBM API Connect server. Because the attacker can dictate external URLs, they may enumerate internal network resources or use the system as a pivot for further exploitation. The core weakness is CWE‑918.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected. The vulnerability applies to the API Connect product bundle deployed by IBM. All builds within that range lack the input validation that prevents intentional SSRF payloads.

The CVSS score is 7.5, indicating a high impact risk. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need valid credentials to the API Connect instance, after which they can issue arbitrary network requests from the server, giving them direct access to internal hosts and services. The potential for information disclosure or further compromise makes this a serious concern for environments that expose the API Connect platform to trusted users.