Live › vulnerability › CVE-2025-11969
The System REST APIs in a WSO2 product do not enforce access control, so users with lower-privilege roles can perform administrative operations they should not reach. A successful attacker gets unauthorized administrative functions on the affected WSO2 product.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 06:21 UTC. All times on this page are UTC.
Anyone running the affected WSO2 products (API Manager 3.1.0 to 4.5.0, API Control Plane, Traffic Manager and Universal Gateway 4.5.0, Identity Server as Key Manager 5.10.0, Open Banking AM/IAM 2.0.0) without the fixed update level. A user with low privileges can perform admin actions through the System REST APIs. WSO2 says APIs you publish through the API Manager's API Gateway are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WSO2 API Manager | vendor | 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 | 4.5.0 U32, 4.4.0 U49, 4.3.0 U85, 4.2.0 U173, 4.1.0 U233, 4.0.0 U370, 3.2.1 U70, 3.2.0 U450, 3.1.0 U347 |
| WSO2 API Control Plane | vendor | 4.5.0 | 4.5.0 U33 |
| WSO2 Traffic Manager | vendor | 4.5.0 | 4.5.0 U31 |
| WSO2 Universal Gateway | vendor | 4.5.0 | 4.5.0 U31 |
| WSO2 Identity Server as Key Manager | vendor | 5.10.0 | 5.10.0 U367 |
| WSO2 Open Banking AM |
| vendor |
| 2.0.0 |
| 2.0.0 U396 |
| WSO2 Open Banking IAM | vendor | 2.0.0 | 2.0.0 U416 |
4.5.0 U32, 4.4.0 U49, 4.3.0 U85, 4.2.0 U173, 4.1.0 U233, 4.0.0 U370, 3.2.1 U70, 3.2.0 U450, 3.1.0 U347; API Control Plane 4.5.0 U33; Traffic Manager and Universal Gateway 4.5.0 U31; IS as Key Manager 5.10.0 U367; Open Banking AM 2.0.0 U396; Open Banking IAM 2.0.0 U416) or higherEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2025-11969")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.