IBM API Connect 12.1.0.0 through 12.1.1.2 contain a missing authorization check that allows low‑privileged users to query arbitrary indices and read sensitive data. The flaw is a direct violation of access control and could lead to the disclosure of confidential information. Because the vulnerability enables data retrieval without proper authorization, the primary impact is a breach of confidentiality. The weakness is classified as Missing Authorization (CWE‑862).

The affected product is IBM API Connect, versions 12.1.0.0 and 12.1.1.2. Users running these releases are at risk of having their data exposed if they can request arbitrary indices through the exposed APIs.

The vulnerability has a CVSS score of 6.5, indicating a moderate to high level of risk. No EPSS score is currently available, so the likelihood of exploitation cannot be quantified at present. It is not listed in the CISA KEV catalog. The likely attack vector is remote API calls to the exposed endpoints that allow index queries, but this inference is based on the nature of the affected product and not explicitly stated in the advisory.