CVE-2025-11969Critical· 9.4▾ MidnightThe System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
api_manager >= 3.1.0 < 3.1.0.347api_manager >= 3.2.0 < 3.2.0.450api_manager >= 3.2.1 < 3.2.1.70api_manager >= 4.0.0 < 4.0.0.370api_manager >= 4.1.0 < 4.1.0.233api_manager >= 4.2.0 < 4.2.0.173api_manager >= 4.3.0 < 4.3.0.85api_manager >= 4.4.0 < 4.4.0.49api_manager >= 4.5.0 < 4.5.0.32identity_server_as_key_manager >= 5.10.0 < 5.10.0.367open_banking_am >= 2.0.0 < 2.0.0.396open_banking_iam >= 2.0.0 < 2.0.0.416api_control_plane >= 4.5.0 < 4.5.0.33universal_gateway >= 4.5.0 < 4.5.0.31traffic_manager >= 4.5.0 < 4.5.0.31org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.6.163 < 6.6.163.159org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.6.163 < 6.6.163.160org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.7.206 < 6.7.206.574org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.7.206 < 6.7.206.576org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.7.210 < 6.7.210.69org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 6.7.210 < 6.7.210.71org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.0.174 < 9.0.174.536org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.20.74 < 9.20.74.384org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.20.74 < 9.20.74.385org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.28.116 < 9.28.116.380org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.29.120 < 9.29.120.202org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.30.67 < 9.30.67.125org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util >= 9.31.86 < 9.31.86.90org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.0.174 < 9.0.174.538org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.20.74 < 9.20.74.385org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.28.116 < 9.28.116.382org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.29.120 < 9.29.120.204org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.30.67 < 9.30.67.126org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common >= 9.31.86 < 9.31.86.91Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2024-5617Medium· 4.8Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2024-12139Medium· 4.3Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
CVE-2026-18800Medium· 4.4Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
CVE-2026-2613High· 8.7SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption