Contradictory risk classification for "Unsafe Consumption of APIs"

[mtausig]

The Exploitability of API10:2023 is graded with the highest rating of easy.
At the same time, the corresponding textual explanation actually tells the opposite, that exploitation of this should be rather hard:

Exploiting this issue requires attackers to identify and potentially compromise other APIs/services the target API integrated with. Usually, this information is not publicly available or the integrated API/service is not easily exploitable.

[kanakamamidiakhil]

Hello, I'm interested in working on this issue. Could you please assign it to me? Thanks!

[ErezYalon]

Tagging this as pending community feedback. This looks like a genuine internal-consistency bug: the "Easy" exploitability rating doesn't match the description, which requires identifying and potentially compromising a separate third-party API/service, more consistent with a harder rating like "Difficult." We'd like community input before changing an official risk rating. @kanakamamidiakhil, since you volunteered for this a while back, feel free to weigh in or take a pass at a PR.