Description
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 4.0.0 – < 4.0.0.384, 4.1.0 – < 4.1.0.248, 4.2.0 – < 4.2.0.188, 4.3.0 – < 4.3.0.99, 4.4.0 – < 4.4.0.63, 4.5.0 – < 4.5.0.48, 4.6.0 – < 4.6.0.12 | 4.0.0.384 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.49, 4.6.0 – < 4.6.0.13 | 4.5.0.49 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.48, 4.6.0 – < 4.6.0.12 | 4.5.0.48 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.47, 4.6.0 – < 4.6.0.12 | 4.5.0.47 |
| WSO2 | WSO2 Carbon API Manager Rest API Common Functions | 9.0.174 – < 9.0.174.550, 9.28.116 – < 9.28.116.404, 9.29.120 – < 9.29.120.221, 9.30.67 – < 9.30.67.146, 9.31.86 – < 9.31.86.130, 9.32.147 – < 9.32.147.26 | 9.0.174.550 |
| WSO2 | WSO2 Carbon API Manager Rest API Utility | 9.20.74 – < 9.20.74.392 | 9.20.74.392 |
Advisories 1
- WID-SEC-2026-2085 WSO2 API Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026