---
id: CVE-2026-2613
title: >-
  SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database
  Information Inference and Service Disruption
summary: >-
  The Admin REST API accepts user-supplied input without adequately sanitizing
  it, allowing it to be included in the structure of SQL statements.


  A user with administrator privileges can exploit this by influencing the
  structure of execut…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 4.0.0 < 4.0.0.387
  - api_manager >= 4.1.0 < 4.1.0.251
  - api_manager >= 4.2.0 < 4.2.0.191
  - api_manager >= 4.3.0 < 4.3.0.102
  - api_manager >= 4.4.0 < 4.4.0.66
  - api_manager >= 4.5.0 < 4.5.0.51
  - api_manager >= 4.6.0 < 4.6.0.15
  - traffic_manager >= 4.5.0 < 4.5.0.50
  - traffic_manager >= 4.6.0 < 4.6.0.15
  - api_control_plane >= 4.5.0 < 4.5.0.52
  - api_control_plane >= 4.6.0 < 4.6.0.16
  - universal_gateway >= 4.5.0 < 4.5.0.51
  - universal_gateway >= 4.6.0 < 4.6.0.15
  - 'org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl < 9.33.25'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:08:32.591612Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:08:53.729Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-2613'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/
tags:
  - cve.org
epss: 0.00367
epssPercentile: 0.30742
ingestedAt: '2026-11-05T19:30:42.719Z'
---

## Overview

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.

A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

## Affected

- `api_manager >= 4.0.0 < 4.0.0.387`
- `api_manager >= 4.1.0 < 4.1.0.251`
- `api_manager >= 4.2.0 < 4.2.0.191`
- `api_manager >= 4.3.0 < 4.3.0.102`
- `api_manager >= 4.4.0 < 4.4.0.66`
- `api_manager >= 4.5.0 < 4.5.0.51`
- `api_manager >= 4.6.0 < 4.6.0.15`
- `traffic_manager >= 4.5.0 < 4.5.0.50`
- `traffic_manager >= 4.6.0 < 4.6.0.15`
- `api_control_plane >= 4.5.0 < 4.5.0.52`
- `api_control_plane >= 4.6.0 < 4.6.0.16`
- `universal_gateway >= 4.5.0 < 4.5.0.51`
- `universal_gateway >= 4.6.0 < 4.6.0.15`
- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl < 9.33.25`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/#solution