{"id":"CVE-2025-11969","kind":"vulnerability","aliases":["CVE-2025-11969"],"related":[],"title":"WSO2 API Manager and related products: System REST APIs let low-privilege users run admin actions (CVE-2025-11969)","description":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.","summary":"The System REST APIs in a WSO2 product do not enforce access control, so users with lower-privilege roles can perform administrative operations they should not reach. A successful attacker gets unauthorized administrative functions on the affected WSO2 product.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WSO2 API Manager","fixed":["4.5.0 U32","4.4.0 U49","4.3.0 U85","4.2.0 U173","4.1.0 U233","4.0.0 U370","3.2.1 U70","3.2.0 U450","3.1.0 U347"],"affected":"3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0","ecosystem":"vendor"},{"name":"WSO2 API Control Plane","fixed":["4.5.0 U33"],"affected":"4.5.0","ecosystem":"vendor"},{"name":"WSO2 Traffic Manager","fixed":["4.5.0 U31"],"affected":"4.5.0","ecosystem":"vendor"},{"name":"WSO2 Universal Gateway","fixed":["4.5.0 U31"],"affected":"4.5.0","ecosystem":"vendor"},{"name":"WSO2 Identity Server as Key Manager","fixed":["5.10.0 U367"],"affected":"5.10.0","ecosystem":"vendor"},{"name":"WSO2 Open Banking AM","fixed":["2.0.0 U396"],"affected":"2.0.0","ecosystem":"vendor"},{"name":"WSO2 Open Banking IAM","fixed":["2.0.0 U416"],"affected":"2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-manager","identity-server","open-banking","other","self-hosted","wso2"],"not_affected_if":["api-gateway-only-exposure"],"how_to_check":"- Find WSO2 products in your estate and compare against the list: API Control Plane 4.5.0; API Manager 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Identity Server as Key Manager 5.10.0; Open Banking AM 2.0.0; Open Banking IAM 2.0.0; Traffic Manager 4.5.0; Universal Gateway 4.5.0\n- Check your installed update level (WSO2 Updates tool) against the fixed level for your version\n- Check whether the System REST API endpoints are reachable from untrusted networks and which low-privilege accounts exist","fix":"Subscription holders: update to the update level in the WSO2 advisory (API Manager 4.5.0 U32, 4.4.0 U49, 4.3.0 U85, 4.2.0 U173, 4.1.0 U233, 4.0.0 U370, 3.2.1 U70, 3.2.0 U450, 3.1.0 U347; API Control Plane 4.5.0 U33; Traffic Manager and Universal Gateway 4.5.0 U31; IS as Key Manager 5.10.0 U367; Open Banking AM 2.0.0 U396; Open Banking IAM 2.0.0 U416) or higher. Community users: apply the public fix in wso2/carbon-apimgt PR 13521, or migrate to the latest unaffected version.","status":"open","published_at":"2026-11-02T06:17:42+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","triaged_at":"2026-11-02T06:23:55+00:00","updated_at":"2026-11-02T06:25:32+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-02T06:23:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WSO2 System REST APIs let low-privilege users run admin actions","impact":"high","summary":"The System REST APIs in a WSO2 product do not enforce access control, so users with lower-privilege roles can perform administrative operations they should not reach. A successful attacker gets unauthorized administrative functions on the affected WSO2 product.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wso2","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Lower-privilege users perform unauthorized administrative operations on the product","analyst_note":"Find the affected WSO2 products, versions and fixed releases from the NVD entry or the WSO2 security advisory.","how_to_check":"- Identify whether WSO2 products with System REST APIs are deployed in your environment\n- Confirm the exact affected product and version ranges against the NVD entry: unknown\n- Review which roles can reach the System REST API endpoints: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["api-gateway-only-exposure"],"who_is_affected":"Teams running WSO2 products that expose the System REST APIs are potentially exposed; the sources state that APIs exposed through the WSO2 API Manager's API Gateway are not affected. The sources do not name the specific products or versions, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000684,"input_tokens":4168,"output_tokens":535,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected WSO2 products, versions and fixed releases from the NVD entry or the WSO2 security advisory.","search":"'-11969':20A,23A,26A '-2025':19A,22A,25A 'access':79B,116C 'action':17A,128C 'actor':148C 'admin':16A 'administr':90B,101B,127C,152C,156C 'affect':105B,140C,170C 'allow':119C 'am':49A 'api':2A,9A,28A,31A,55B,71B,111C,158C,163C,166C 'api-manag':54B 'as':43A 'attack':98B 'bank':62B 'banking':48A,52A 'control':32A,80B,117C 'correct':114C 'could':144C 'cve':18A,21A,24A 'enabl':145C 'enforc':78B,115C 'execut':126C,155C 'exploit':143C 'expos':159C 'function':102B,157C 'gateway':39A,167C 'get':99B 'host':66B 'iam':53A 'ident':58B 'identity':41A 'identity-serv':57B 'includ':154C 'key':44A 'let':10A 'low':12A 'low-privileg':11A 'lower':85B,122C 'lower-privileg':84B 'malici':147C 'manag':3A,56B,164C 'manager':29A,36A,45A 'mechan':118C 'open':47A,51A,61B 'open-bank':60B 'oper':91B,137C,153C 'perform':89B,150C 'permit':135C 'plane':33A 'privileg':13A,86B,123C 'product':6A,75B,107B,141C 'reach':95B 'relat':5A 'rest':8A,70B,110C 'restrict':132C 'role':87B,124C 'run':15A 'self':65B 'self-host':64B 'server':42A,59B 'success':97B,142C 'system':7A,69B,109C 'traffic':35A 'unauthor':100B,136C,151C 'universal':38A 'user':14A,82B,120C 'vulner':173C 'weak':134C 'wso2':1A,27A,30A,34A,37A,40A,46A,50A,67B,74B,106B,162C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the affected WSO2 products (API Manager 3.1.0 to 4.5.0, API Control Plane, Traffic Manager and Universal Gateway 4.5.0, Identity Server as Key Manager 5.10.0, Open Banking AM/IAM 2.0.0) without the fixed update level. A user with low privileges can perform admin actions through the System REST APIs. WSO2 says APIs you publish through the API Manager's API Gateway are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-02T06:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13521","run_id":1353},"products":{"at":"2026-11-02T06:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13521","run_id":1353},"how_to_check":{"at":"2026-11-02T06:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13521","run_id":1353},"who_affected":{"at":"2026-11-02T06:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13521","run_id":1353}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apicontrolplane","apimanager","identityserveraskeymanager","openbankingam","openbankingiam","trafficmanager","universalgateway","wso2apicontrolplane","wso2apimanager","wso2identityserveraskeymanager","wso2openbankingam","wso2openbankingiam","wso2trafficmanager","wso2universalgateway"],"ptokens":["am","api","as","banking","control","gateway","iam","identity","key","manager","open","plane","server","traffic","universal","wso2"],"labels":["apimanager","critical","identityserver","openbanking","other","selfhosted","wso2"],"first_public_at":"2026-11-02T06:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-11969","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11969","severity":null,"published_at":"2026-11-02T06:17:42+00:00","modified_at":"2026-11-02T06:17:42+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","fetched_at":"2026-11-02T06:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-11969:1353","url":null,"severity":null,"published_at":"2026-11-02T06:25:32+00:00","modified_at":"2026-11-02T06:25:32+00:00","first_seen_at":"2026-11-02T06:25:32+00:00","fetched_at":"2026-11-02T06:25:32+00:00","note":"Read WSO2-2025-4733 advisory (primary): affected products/versions, update levels, public fix PR carbon-apimgt#13521. No exploitation or PoC seen; did not search social."}],"documents":[{"id":50600,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/","title":"WSO2-2025-4733 / CVE-2025-11969","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":50601,"url":"https://github.com/wso2/carbon-apimgt/pull/13521","title":"carbon-apimgt PR 13521 (public fix)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}