--- id: "CVE-2025-11969" kind: "vulnerability" aliases: ["CVE-2025-11969"] title: "WSO2 API Manager and related products: System REST APIs let low-privilege users run admin actions (CVE-2025-11969)" severity: "critical" cvss: 9.4 epss: null exploited: false status: "open" category: "other" products: [{"name": "WSO2 API Manager", "fixed": ["4.5.0 U32", "4.4.0 U49", "4.3.0 U85", "4.2.0 U173", "4.1.0 U233", "4.0.0 U370", "3.2.1 U70", "3.2.0 U450", "3.1.0 U347"], "affected": "3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0", "ecosystem": "vendor"}, {"name": "WSO2 API Control Plane", "fixed": ["4.5.0 U33"], "affected": "4.5.0", "ecosystem": "vendor"}, {"name": "WSO2 Traffic Manager", "fixed": ["4.5.0 U31"], "affected": "4.5.0", "ecosystem": "vendor"}, {"name": "WSO2 Universal Gateway", "fixed": ["4.5.0 U31"], "affected": "4.5.0", "ecosystem": "vendor"}, {"name": "WSO2 Identity Server as Key Manager", "fixed": ["5.10.0 U367"], "affected": "5.10.0", "ecosystem": "vendor"}, {"name": "WSO2 Open Banking AM", "fixed": ["2.0.0 U396"], "affected": "2.0.0", "ecosystem": "vendor"}, {"name": "WSO2 Open Banking IAM", "fixed": ["2.0.0 U416"], "affected": "2.0.0", "ecosystem": "vendor"}] ecosystems: [] tags: ["api-manager", "identity-server", "open-banking", "other", "self-hosted", "wso2"] not_affected_if: ["api-gateway-only-exposure"] published_at: "2026-11-02T06:17:42+00:00" first_seen_at: "2026-11-02T06:21:54+00:00" updated_at: "2026-11-02T06:25:32+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11969", "first_seen_at": "2026-11-02T06:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T06:25:32+00:00"}] --- # WSO2 API Manager and related products: System REST APIs let low-privilege users run admin actions (CVE-2025-11969) The System REST APIs in a WSO2 product do not enforce access control, so users with lower-privilege roles can perform administrative operations they should not reach. A successful attacker gets unauthorized administrative functions on the affected WSO2 product. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:WSO2 API Manager affected 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 fixed 4.5.0 U32, 4.4.0 U49, 4.3.0 U85, 4.2.0 U173, 4.1.0 U233, 4.0.0 U370, 3.2.1 U70, 3.2.0 U450, 3.1.0 U347 - vendor:WSO2 API Control Plane affected 4.5.0 fixed 4.5.0 U33 - vendor:WSO2 Traffic Manager affected 4.5.0 fixed 4.5.0 U31 - vendor:WSO2 Universal Gateway affected 4.5.0 fixed 4.5.0 U31 - vendor:WSO2 Identity Server as Key Manager affected 5.10.0 fixed 5.10.0 U367 - vendor:WSO2 Open Banking AM affected 2.0.0 fixed 2.0.0 U396 - vendor:WSO2 Open Banking IAM affected 2.0.0 fixed 2.0.0 U416 ## How to check - Find WSO2 products in your estate and compare against the list: API Control Plane 4.5.0; API Manager 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Identity Server as Key Manager 5.10.0; Open Banking AM 2.0.0; Open Banking IAM 2.0.0; Traffic Manager 4.5.0; Universal Gateway 4.5.0 - Check your installed update level (WSO2 Updates tool) against the fixed level for your version - Check whether the System REST API endpoints are reachable from untrusted networks and which low-privilege accounts exist ## Fix Subscription holders: update to the update level in the WSO2 advisory (API Manager 4.5.0 U32, 4.4.0 U49, 4.3.0 U85, 4.2.0 U173, 4.1.0 U233, 4.0.0 U370, 3.2.1 U70, 3.2.0 U450, 3.1.0 U347; API Control Plane 4.5.0 U33; Traffic Manager and Universal Gateway 4.5.0 U31; IS as Key Manager 5.10.0 U367; Open Banking AM 2.0.0 U396; Open Banking IAM 2.0.0 U416) or higher. Community users: apply the public fix in wso2/carbon-apimgt PR 13521, or migrate to the latest unaffected version. ## Timeline - 2026-11-02T06:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-11969 - 2026-11-02T06:25:32+00:00 analyst — Read WSO2-2025-4733 advisory (primary): affected products/versions, update levels, public fix PR carbon-apimgt#13521. No exploitation or PoC seen; did not search social. ## Documents - [advisory] WSO2-2025-4733 / CVE-2025-11969 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/ - [fix] carbon-apimgt PR 13521 (public fix) https://github.com/wso2/carbon-apimgt/pull/13521 ## From the sources The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_