{"id":"CVE-2025-11229","kind":"vulnerability","aliases":["CVE-2025-11229"],"related":[],"title":"WSO2 Identity Server: client credentials grant can obtain all API scopes when authorize_all_scopes is enabled","description":"The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.\n\nExploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.","summary":"WSO2 Identity Server 7.0.0 and 7.1.0 deployments that set authorize_all_scopes = true in deployment.toml let applications using the client credentials grant obtain all API scopes, including internal and console scopes, without explicit authorization. The setting is disabled by default.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WSO2 Identity Server","fixed":["7.0.0 update level 125","7.1.0 update level 32"],"affected":"7.0.0, 7.1.0 (only with authorize_all_scopes = true)","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-scopes","client-credentials","oauth","other","self-hosted","wso2","wso2-identity-server"],"not_affected_if":["authorize_all_scopes-disabled","default-config"],"how_to_check":"Open <Product_Home>/repository/conf/deployment.toml. If the [oauth] section has authorize_all_scopes = true, you are exposed. If it is absent or set to false, the vulnerable behavior is disabled. Applies to WSO2 Identity Server 7.0.0 and 7.1.0.","fix":"Community: apply the public fix in https://github.com/wso2/carbon-identity-framework/pull/7252 or move to the latest unaffected release. Subscribers: update to U2 update level 32 or higher for IS 7.1.0, or 125 or higher for IS 7.0.0. After the fix, add authorize_internal_scopes = false under [oauth] next to authorize_all_scopes = true so internal scopes are not granted through client credentials.","status":"open","published_at":"2026-11-04T06:16:54+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:25:57+00:00","updated_at":"2026-11-04T06:27:05+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-04T06:25:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OAuth client credentials grant can obtain all API scopes when misconfigured","impact":"high","summary":"When the authorize_all_scopes setting is enabled, clients using the OAuth client credentials grant receive every API scope, including internal and console scopes, without explicit approval. An attacker holding such a client's credentials can perform administrative actions and read confidential data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["oauth","client-credentials","api-scopes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Unprivileged clients gain administrative actions and confidential organizational data access","analyst_note":"Identify the affected product and fixed versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-11229) and the vendor advisory.","how_to_check":"- Check whether the `authorize_all_scopes` configuration is set to enabled in the affected system's configuration\n- Review which clients use the client credentials grant type and what scopes they receive\n- Product names and the affected versions are not stated in the sources: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only deployments where the `authorize_all_scopes` setting deviates from its default disabled state are described as exposed. Applications that use the OAuth client credentials grant are the path, so teams running such a configuration should review their clients' scopes. Deployments with the default disabled setting are not described as affected. The affected product and versions are not named in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4216,"output_tokens":590,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and fixed versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-11229) and the vendor advisory.","search":"'-11229':20A,23A '-2025':19A,22A '7.0.0':46B '7.1.0':48B 'access':125C,144C 'account':152C 'achiev':150C 'action':143C 'administr':142C 'allow':100C 'api':10A,28B,67B,111C 'api-scop':27B 'applic':59B,101C 'author':13A,52B,76B,90C,93C,122C,158C 'bypass':123C 'client':4A,31B,62B,104C,138C 'client-credenti':30B 'confidenti':145C 'configur':96C,161C 'consol':72B,117C 'control':126C 'credenti':5A,32B,63B,105C 'cve':18A,21A 'data':147C 'default':82B,165C 'deploy':49B,155C 'deployment.toml':57B 'deviat':162C 'disabl':80B,166C 'enabl':17A,98C,136C 'enforc':88C 'escal':135C 'explicit':75B,121C 'exploit':127C 'fail':85C 'full':151C 'grant':6A,64B,106C 'host':37B 'ident':2A,41B,44B 'identity':25A 'includ':69B,113C 'intend':124C 'intern':70B,115C 'lead':132C 'let':58B 'oauth':33B 'obtain':8A,65B,109C 'organiz':146C 'perform':140C 'potenti':149C 'privileg':134C 'proper':87C 'requir':120C 'scope':11A,15A,29B,54B,68B,73B,89C,95C,112C,118C,160C 'self':36B 'self-host':35B 'sensit':114C 'server':3A,26A,42B,45B 'set':51B,78B 'state':167C 'system':84C 'takeov':153C 'true':55B 'type':107C 'unauthor':141C 'unprivileg':137C 'use':60B,102C 'vulner':130C 'without':74B,119C 'wso2':1A,24A,38B,40B,43B 'wso2-identity-server':39B","nicknames":[],"mitigations":[],"who_affected":"Only WSO2 Identity Server 7.0.0 and 7.1.0 deployments with authorize_all_scopes = true in the [oauth] section of deployment.toml are exposed. Any client that uses the client credentials grant can then get every API scope, including internal and console scopes. Deployments with the setting absent or false can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T06:27:05Z","by":"analyst","doc":"https://github.com/wso2/carbon-identity-framework/pull/7252","run_id":1639},"products":{"at":"2026-11-04T06:27:05Z","by":"analyst","doc":"https://github.com/wso2/carbon-identity-framework/pull/7252","run_id":1639},"how_to_check":{"at":"2026-11-04T06:27:05Z","by":"analyst","doc":"https://github.com/wso2/carbon-identity-framework/pull/7252","run_id":1639},"who_affected":{"at":"2026-11-04T06:27:05Z","by":"analyst","doc":"https://github.com/wso2/carbon-identity-framework/pull/7252","run_id":1639}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["identityserver","wso2identityserver"],"ptokens":["identity","server","wso2"],"labels":["apiscopes","clientcredentials","high","oauth","other","selfhosted","wso2","wso2identityserver"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-11229","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11229","severity":null,"published_at":"2026-11-04T06:16:54+00:00","modified_at":"2026-11-04T06:16:54+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-11229:1639","url":null,"severity":null,"published_at":"2026-11-04T06:27:05+00:00","modified_at":"2026-11-04T06:27:05+00:00","first_seen_at":"2026-11-04T06:27:05+00:00","fetched_at":"2026-11-04T06:27:05+00:00","note":"Read WSO2 advisory WSO2-2025-4525 (primary). Affects IS 7.0.0/7.1.0 only when authorize_all_scopes=true; fix levels U2 125/32 and PR 7252. No exploitation or PoC found."}],"documents":[{"id":64771,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/","title":"WSO2-2025-4525 / CVE-2025-11229","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":64772,"url":"https://github.com/wso2/carbon-identity-framework/pull/7252","title":"carbon-identity-framework PR 7252: authorize_internal_scopes fix","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}