Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

Summary

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Timeline

1. Aug 6, 2026, 5:32 PM UTCCVE published
2. Aug 7, 2026, 5:48 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 7, 2026, 5:48 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 API Manager

  From 4.1.0 · fixed in 4.1.0.242; From 4.2.0 · fixed in 4.2.0.182; From 4.3.0 · fixed in 4.3.0.93; From 4.4.0 · fixed in 4.4.0.57; From 4.5.0 · fixed in 4.5.0.41; From 4.6.0 · fixed in 4.6.0.6

• WSO2 WSO2 API Control Plane

  From 4.5.0 · fixed in 4.5.0.42; From 4.6.0 · fixed in 4.6.0.7

• WSO2 WSO2 Traffic Manager

  From 4.5.0 · fixed in 4.5.0.40; From 4.6.0 · fixed in 4.6.0.6

• WSO2 WSO2 Universal Gateway

  From 4.5.0 · fixed in 4.5.0.40; From 4.6.0 · fixed in 4.6.0.6

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl

  From 9.20.74 · fixed in 9.20.74.388; From 9.28.116 · fixed in 9.28.116.395; From 9.29.120 · fixed in 9.29.120.213; From 9.30.67 · fixed in 9.30.67.135; From 9.31.86 · fixed in 9.31.86.108; From 9.32.147 · fixed in 9.32.147.5

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

  From 9.20.74 · fixed in 9.20.74.388; From 9.28.116 · fixed in 9.28.116.395; From 9.29.120 · fixed in 9.29.120.213; From 9.30.67 · fixed in 9.30.67.135; From 9.31.86 · fixed in 9.31.86.108; From 9.32.147 · fixed in 9.32.147.5

References 1