---
id: "CVE-2025-11229"
kind: "vulnerability"
aliases: ["CVE-2025-11229"]
title: "WSO2 Identity Server: client credentials grant can obtain all API scopes when authorize_all_scopes is enabled"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WSO2 Identity Server", "fixed": ["7.0.0 update level 125", "7.1.0 update level 32"], "affected": "7.0.0, 7.1.0 (only with authorize_all_scopes = true)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-scopes", "client-credentials", "oauth", "other", "self-hosted", "wso2", "wso2-identity-server"]
not_affected_if: ["authorize_all_scopes-disabled", "default-config"]
published_at: "2026-11-04T06:16:54+00:00"
first_seen_at: "2026-11-04T06:25:17+00:00"
updated_at: "2026-11-04T06:27:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11229", "first_seen_at": "2026-11-04T06:25:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T06:27:05+00:00"}]
---

# WSO2 Identity Server: client credentials grant can obtain all API scopes when authorize_all_scopes is enabled

WSO2 Identity Server 7.0.0 and 7.1.0 deployments that set authorize_all_scopes = true in deployment.toml let applications using the client credentials grant obtain all API scopes, including internal and console scopes, without explicit authorization. The setting is disabled by default.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WSO2 Identity Server affected 7.0.0, 7.1.0 (only with authorize_all_scopes = true) fixed 7.0.0 update level 125, 7.1.0 update level 32

## How to check

Open <Product_Home>/repository/conf/deployment.toml. If the [oauth] section has authorize_all_scopes = true, you are exposed. If it is absent or set to false, the vulnerable behavior is disabled. Applies to WSO2 Identity Server 7.0.0 and 7.1.0.

## Fix

Community: apply the public fix in https://github.com/wso2/carbon-identity-framework/pull/7252 or move to the latest unaffected release. Subscribers: update to U2 update level 32 or higher for IS 7.1.0, or 125 or higher for IS 7.0.0. After the fix, add authorize_internal_scopes = false under [oauth] next to authorize_all_scopes = true so internal scopes are not granted through client credentials.

## Timeline

- 2026-11-04T06:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-11229
- 2026-11-04T06:27:05+00:00 analyst — Read WSO2 advisory WSO2-2025-4525 (primary). Affects IS 7.0.0/7.1.0 only when authorize_all_scopes=true; fix levels U2 125/32 and PR 7252. No exploitation or PoC found.

## Documents

- [advisory] WSO2-2025-4525 / CVE-2025-11229 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/
- [fix] carbon-identity-framework PR 7252: authorize_internal_scopes fix https://github.com/wso2/carbon-identity-framework/pull/7252

## From the sources

The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.

Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_