Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Summary

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Timeline

1. Aug 6, 2026, 7:33 AM UTCCVE published
2. Aug 6, 2026, 12:31 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Aug 6, 2026, 12:31 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 API Manager

  From 4.0.0 · fixed in 4.0.0.384; From 4.1.0 · fixed in 4.1.0.248; From 4.2.0 · fixed in 4.2.0.188; From 4.3.0 · fixed in 4.3.0.99; From 4.4.0 · fixed in 4.4.0.63; From 4.5.0 · fixed in 4.5.0.48; From 4.6.0 · fixed in 4.6.0.12

• WSO2 WSO2 API Control Plane

  From 4.5.0 · fixed in 4.5.0.49; From 4.6.0 · fixed in 4.6.0.13

• WSO2 WSO2 Universal Gateway

  From 4.5.0 · fixed in 4.5.0.48; From 4.6.0 · fixed in 4.6.0.12

• WSO2 WSO2 Traffic Manager

  From 4.5.0 · fixed in 4.5.0.47; From 4.6.0 · fixed in 4.6.0.12

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common

  From 9.0.174 · fixed in 9.0.174.550; From 9.28.116 · fixed in 9.28.116.404; From 9.29.120 · fixed in 9.29.120.221; From 9.30.67 · fixed in 9.30.67.146; From 9.31.86 · fixed in 9.31.86.130; From 9.32.147 · fixed in 9.32.147.26

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

  From 9.20.74 · fixed in 9.20.74.392

References 1