WSO2 IDENTITY SERVER · CVE-2025-11229 · Other
FIX → 7.0.0 update level 125 · 7.1.0 update level 32 ✓ verified
WSO2 Identity Server 7.0.0 and 7.1.0 deployments that set authorize_all_scopes = true in deployment.toml let applications using the client credentials grant obtain all API scopes, including internal and console scopes, without explicit authorization. The setting is disabled by default.
first public Nov 4, 2026 · 2 sources
Running WSO2 Identity Server? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only WSO2 Identity Server 7.0.0 and 7.1.0 deployments with authorize_all_scopes = true in the [oauth] section of deployment.toml are exposed. Any client that uses the client credentials grant can then get every API scope, including internal and console scopes. Deployments with the setting absent or false can skip it.
Not affected if authorize_all_scopes-disabled, default-config
Who cares api-scopes, client-credentials, oauth, self-hosted, wso2, wso2-identity-server
7.0.0 and 7.1.0The system fails to properly enforce scope authorization when the authorize_all_scopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.
Upgrade to 7.0.0 update level 125 · 7.1.0 update level 32
7.1.0, or 125 or higher for IS 7.0.0Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the authorize_all_scopes configuration deviates from its default disabled state.
This page as .md · .json · in your agent: get_signal("CVE-2025-11229") · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.