Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
Summary
| CVE | CVE-2025-11969 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-02 06:17:42 UTC |
| Updated | 2026-11-02 06:17:42 UTC |
| Description | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability. |
Risk And Classification
Primary CVSS: v3.1 9.4 CRITICAL from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Problem Types: CWE-285 | CWE-285 CWE-285: Improper Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 9.4 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| 3.1 | CNA | CVSS | 9.4 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 API Manager | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.347 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.450 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.70 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.370 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.233 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.173 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.85 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.4.0 4.4.0.49 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.5.0 4.5.0.32 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.367 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.396 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.416 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.5.0 4.5.0.33 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.5.0 4.5.0.31 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | unknown 4.5.0 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.5.0 4.5.0.31 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.6.163 6.6.163.159 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.6.163 6.6.163.160 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.7.206 6.7.206.574 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.7.206 6.7.206.576 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.7.210 6.7.210.69 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 6.7.210 6.7.210.71 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.0.174 9.0.174.536 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.20.74 9.20.74.384 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.20.74 9.20.74.385 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.28.116 9.28.116.380 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.29.120 9.29.120.202 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.30.67 9.30.67.125 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | affected 9.31.86 9.31.86.90 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Utility | unaffected 9.32.147 * custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.0.174 9.0.174.538 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.20.74 9.20.74.385 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.28.116 9.28.116.382 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.29.120 9.29.120.204 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.30.67 9.30.67.126 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | affected 9.31.86 9.31.86.91 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon API Manager Rest API Common Functions | unaffected 9.32.147 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution
There are currently no legacy QID mappings associated with this CVE.