{"id":"CVE-2026-2613","kind":"vulnerability","aliases":["CVE-2026-2613"],"related":[],"title":"WSO2 API Manager and related products: blind SQL injection in Admin REST API by administrators","description":"The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.\n\nA user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.","summary":"WSO2 advisory WSO2-2026-5100: the Admin REST API lets an authenticated administrator influence the structure of SQL statements, enabling blind SQL injection to infer database contents or affect database availability. CVSS 8.7. No exploitation reported.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WSO2 API Manager","fixed":["4.6.0 U15","4.5.0 U51","4.4.0 U66","4.3.0 U102","4.2.0 U191","4.1.0 U251","4.0.0 U387"],"affected":"4.0.0 - 4.6.0","ecosystem":"vendor"},{"name":"WSO2 API Control Plane","fixed":["4.6.0 U16","4.5.0 U52"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"},{"name":"WSO2 Traffic Manager","fixed":["4.6.0 U15","4.5.0 U50"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"},{"name":"WSO2 Universal Gateway","fixed":["4.6.0 U15","4.5.0 U51"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["admin-rest-api","api-manager","other","self-hosted","sql-injection","wso2"],"not_affected_if":["admin-api-not-exposed","no-admin-rest-api-exposed"],"how_to_check":"Check your WSO2 product and version (API Manager, API Control Plane, Traffic Manager, Universal Gateway). Affected: API Manager 4.0.0-4.6.0; API Control Plane, Traffic Manager, Universal Gateway 4.5.0 and 4.6.0. Subscribers: confirm your update level is at or above the fixed level listed in the advisory.","fix":"Subscription holders: update to the update level in the advisory (API Manager 4.6.0 U15, 4.5.0 U51, 4.4.0 U66, 4.3.0 U102, 4.2.0 U191, 4.1.0 U251, 4.0.0 U387; Control Plane 4.6.0 U16, 4.5.0 U52; Traffic Manager 4.6.0 U15, 4.5.0 U50; Universal Gateway 4.6.0 U15, 4.5.0 U51). Community users: apply https://github.com/wso2/carbon-apimgt/pull/13624 or move to the latest unaffected release.","status":"open","published_at":"2026-11-02T11:17:31+00:00","first_seen_at":"2026-11-02T11:22:54+00:00","triaged_at":"2026-11-02T11:24:12+00:00","updated_at":"2026-11-02T11:25:32+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-02T11:24:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Admin REST API: unsanitized input enables blind SQL injection by administrators","impact":"medium","summary":"The Admin REST API passes user-supplied input into the structure of SQL statements without adequate sanitizing. An attacker with administrator privileges can infer database contents and potentially disrupt the database service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["admin-rest-api"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"database contents leaked and database service availability disrupted","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-2613, since the sources give no product name or fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-admin-rest-api-exposed"],"who_is_affected":"Only accounts with administrator privileges can trigger it, according to the description, so exposure depends on who holds admin access to the affected Admin REST API. The sources do not name the affected product or versions, so the team cannot yet tell whether its systems run the flawed code.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4129,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-2613, since the sources give no product name or fix.","search":"'-2026':17A,20A,53B '-2613':18A,21A '-5100':54B '8.7':82B 'accept':90C 'adequ':96C 'admin':11A,36B,56B,87C 'admin-rest-api':35B 'administr':15A,62B,113C 'advisori':51B 'affect':78B 'allow':99C 'api':2A,13A,23A,26A,38B,40B,58B,89C 'api-manag':39B 'authent':61B 'avail':80B,138C 'blind':7A,70B,127C 'content':76B 'control':27A 'cve':16A,19A 'cvss':81B 'databas':75B,79B,132C,141C 'enabl':69B,126C 'execut':123C 'exploit':84B,116C 'gateway':34A 'host':45B 'impact':136C 'includ':103C 'infer':74B,131C 'influenc':63B,119C 'inform':133C 'inject':9A,48B,72B,129C 'input':94C 'let':59B 'manag':3A,41B 'manager':24A,31A 'plane':28A 'potenti':135C 'privileg':114C 'product':6A 'relat':5A 'report':85B 'rest':12A,37B,57B,88C 'sanit':97C 'self':44B 'self-host':43B 'servic':142C 'sql':8A,47B,67B,71B,108C,124C,128C 'sql-inject':46B 'statement':68B,109C,125C 'structur':65B,106C,121C 'suppli':93C 'traffic':30A 'universal':33A 'user':92C,111C 'user-suppli':91C 'without':95C 'wso2':1A,22A,25A,29A,32A,49B,50B,52B","nicknames":[],"mitigations":[],"who_affected":"Only accounts with administrator privileges can trigger it, according to the description, so exposure depends on who holds admin access to the affected Admin REST API. The sources do not name the affected product or versions, so the team cannot yet tell whether its systems run the flawed code.","tier":"B","verified":{"fix":{"at":"2026-11-02T11:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13624","run_id":1366},"products":{"at":"2026-11-02T11:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13624","run_id":1366},"how_to_check":{"at":"2026-11-02T11:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13624","run_id":1366},"who_affected":{"at":"2026-11-02T11:25:32Z","by":"analyst","doc":"https://github.com/wso2/carbon-apimgt/pull/13624","run_id":1366}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apicontrolplane","apimanager","trafficmanager","universalgateway","wso2apicontrolplane","wso2apimanager","wso2trafficmanager","wso2universalgateway"],"ptokens":["api","control","gateway","manager","plane","traffic","universal","wso2"],"labels":["adminrestapi","apimanager","high","other","selfhosted","sqlinjection","wso2"],"first_public_at":"2026-11-02T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-2613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2613","severity":null,"published_at":"2026-11-02T11:17:31+00:00","modified_at":"2026-11-02T11:17:31+00:00","first_seen_at":"2026-11-02T11:22:54+00:00","fetched_at":"2026-11-02T11:22:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-2613:1366","url":null,"severity":null,"published_at":"2026-11-02T11:25:32+00:00","modified_at":"2026-11-02T11:25:32+00:00","first_seen_at":"2026-11-02T11:25:32+00:00","fetched_at":"2026-11-02T11:25:32+00:00","note":"Primary WSO2 advisory WSO2-2026-5100 read; affected products, update levels and public fix PR taken from it. Admin privileges required (PR:H). No exploitation or PoC found. Did not search social posts (low-profile, B tier)."}],"documents":[{"id":51634,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/","title":"WSO2-2026-5100 / CVE-2026-2613","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":51635,"url":"https://github.com/wso2/carbon-apimgt/pull/13624","title":"carbon-apimgt PR 13624","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}