CVE-2026-2613High· 8.7▾ TwilightThe Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of execut…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.
A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
api_manager >= 4.0.0 < 4.0.0.387api_manager >= 4.1.0 < 4.1.0.251api_manager >= 4.2.0 < 4.2.0.191api_manager >= 4.3.0 < 4.3.0.102api_manager >= 4.4.0 < 4.4.0.66api_manager >= 4.5.0 < 4.5.0.51api_manager >= 4.6.0 < 4.6.0.15traffic_manager >= 4.5.0 < 4.5.0.50traffic_manager >= 4.6.0 < 4.6.0.15api_control_plane >= 4.5.0 < 4.5.0.52api_control_plane >= 4.6.0 < 4.6.0.16universal_gateway >= 4.5.0 < 4.5.0.51universal_gateway >= 4.6.0 < 4.6.0.15org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl < 9.33.25Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2024-5617Medium· 4.8Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2025-11969Critical· 9.4Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
CVE-2024-12139Medium· 4.3Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
CVE-2026-18800Medium· 4.4Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data