Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

WSO2 products let low‑privilege users perform admin actions

CVE-2025-11969 · published 2 days ago
Summary

The system APIs in WSO2 API Manager, Identity Server (as key manager), Open Banking AM, Open Banking IAM, and API Control Plane do not properly check user permissions, so users with basic roles can carry out tasks meant for administrators. This could let an attacker change settings or manage the system without authorization. Apply the latest security updates from WSO2 and review your access‑control policies to ensure only trusted accounts can use administrative functions.

What to do
  • Update wso2 wso2 api manager to version 3.1.0.347 or later.
  • Update wso2 wso2 identity server as key manager to version 5.10.0.367 or later.
  • Update wso2 wso2 open banking am to version 2.0.0.396 or later.
  • Update wso2 wso2 open banking iam to version 2.0.0.416 or later.
  • Update wso2 wso2 api control plane to version 4.5.0.33 or later.
  • Update wso2 wso2 universal gateway to version 4.5.0.31 or later.
  • Update wso2 wso2 traffic manager to version 4.5.0.31 or later.
  • Update wso2 wso2 carbon api manager rest api utility to version 6.6.163.159 or later.
  • Update wso2 wso2 carbon api manager rest api common functions to version 9.0.174.538 or later.
Affected software
VendorProductAffected versions
wso2 wso2 api manager < 3.1.0.347
wso2 wso2 identity server as key manager < 5.10.0.367
wso2 wso2 open banking am < 2.0.0.396
wso2 wso2 open banking iam < 2.0.0.416
wso2 wso2 api control plane < 4.5.0.33
wso2 wso2 universal gateway < 4.5.0.31
wso2 wso2 traffic manager < 4.5.0.31
wso2 wso2 carbon api manager rest api utility < 6.6.163.159
wso2 wso2 carbon api manager rest api common functions < 9.0.174.538
Original advisory text
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.

Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2025-11969 · NVD
CVE-2025-11969 · MITRE
Track software like this
Free during beta