Skip to content
OpenAdvisories

Product · WSO2

WSO2 Carbon API Management Implementation

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-8325

    Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

    The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, pote…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
  • Medium 5.3
    CVE-2025-8154

    HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

    In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can in…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager