{"id":"CVE-2026-4052","kind":"vulnerability","aliases":["CVE-2026-4052"],"related":[],"title":"WSO2 API Manager: self-registered users can reach admin System REST APIs when Identity Server is Resident Key Manager","description":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.","summary":"In WSO2 Identity Server deployments configured as a Resident Key Manager with database sharing, a self-registered user can get a token from the Identity Server token endpoint. That token can then be used to access the System REST APIs of WSO2 API Manager.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WSO2 API Manager","fixed":["latest U2 update level + updated IS connector"],"affected":"4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0 (only with WSO2 Identity Server as Resident Key Manager with database sharing)","ecosystem":"vendor"},{"name":"WSO2 API Control Plane","fixed":["latest U2 update level + updated IS connector"],"affected":"4.5.0, 4.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","privilege-escalation","self-hosted","wso2","wso2-api-manager","wso2-identity-server"],"not_affected_if":["default-config","managed-hosting","no-database-sharing","no-resident-key-manager"],"how_to_check":"1. Confirm you run WSO2 API Manager 4.1.0-4.6.0 or API Control Plane 4.5.0/4.6.0. 2. Check whether WSO2 Identity Server is configured as Resident Key Manager with database sharing between IS and APIM. 3. Check whether users can self-register (the advisory describes a self-registered user as the attacker). 4. Check the update level of IS and APIM and the keymanager-operations.war and wso2is.key.manager.core jar versions under the IS install.","fix":"Per WSO2: update Identity Server and API Manager to the latest U2 update level; download the latest WSO2 IS connector (APIM docs, Step 4 of 'Configuring WSO2 Identity Server as a Key Manager'); replace wso2is.key.manager.core and wso2is.notification.event.handlers jars in repository/components/dropins; remove old keymanager-operations.war and directory from repository/deployment/server/webapps and add the new war; restart IS.","status":"open","published_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","triaged_at":"2026-11-03T08:19:37+00:00","updated_at":"2026-11-03T08:20:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T08:19:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WSO2 Identity Server: self-registered users can reach API Manager admin APIs","impact":"high","summary":"In WSO2 Identity Server deployments configured as a Resident Key Manager with database sharing, a self-registered user can get a token from the Identity Server token endpoint. That token can then be used to access the System REST APIs of WSO2 API Manager.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wso2","wso2-identity-server","wso2-api-manager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Self-registered user reaches API Manager administrative REST APIs","analyst_note":"Sources give only the NVD entry; check the WSO2 security advisory for affected and fixed versions and confirm whether self-registration is required.","how_to_check":"- Check whether WSO2 Identity Server is configured as a Resident Key Manager with database sharing.\n- Check the installed version of WSO2 Identity Server and WSO2 API Manager against the affected ranges, which the sources do not list: unknown.\n- Check whether self-registration of users is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-resident-key-manager","no-database-sharing"],"who_is_affected":"Only deployments where WSO2 Identity Server is set up as a Resident Key Manager with database sharing are described as affected. In those environments, a self-registered user may obtain a token and reach the System REST APIs of WSO2 API Manager. Teams running standalone Identity Server or API Manager without this setup are described as not affected, though the sources do not state that explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00073,"input_tokens":4123,"output_tokens":635,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD entry; check the WSO2 security advisory for affected and fixed versions and confirm whether self-registration is required.","search":"'-2026':22A,25A '-4052':23A,26A 'access':86B,124C 'admin':10A 'api':2A,13A,28A,31A,44B,90B,93B,129C,132C 'configur':55B,105C 'control':32A 'cve':21A,24A 'databas':62B,112C 'deploy':54B,99C 'endpoint':78B,144C 'environ':116C 'escal':37B 'gain':123C 'get':70B 'host':40B 'ident':15A,48B,52B,75B,102C,141C 'impact':98C 'infrastructur':34B 'issu':96C 'key':19A,59B,109C 'manag':3A,20A,45B,60B,94B,110C,133C 'manager':29A 'may':122C 'obtain':135C 'plane':33A 'privileg':36B 'privilege-escal':35B 'reach':9A 'regist':6A,67B,120C 'resid':18A,58B,108C 'rest':12A,89B,128C 'self':5A,39B,66B,119C 'self-host':38B 'self-regist':4A,65B,118C 'server':16A,49B,53B,76B,103C,142C 'share':63B,113C 'system':11A,88B,127C 'token':72B,77B,80B,137C,143C 'use':84B 'user':7A,68B,121C 'wso2':1A,27A,30A,41B,43B,47B,51B,92B,101C,131C,140C 'wso2-api-manager':42B 'wso2-identity-server':46B","nicknames":[],"mitigations":[],"who_affected":"Only WSO2 API Manager 4.1.0 to 4.6.0 (and API Control Plane 4.5.0/4.6.0) deployments that use WSO2 Identity Server as a Resident Key Manager with a shared database are exposed. There, a self-registered user can get a token from the Identity Server token endpoint and call API Manager's System REST APIs, potentially taking over an admin account. Deployments with another key manager or without database sharing can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T08:20:28Z","by":"analyst","doc":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","run_id":1465},"products":{"at":"2026-11-03T08:20:28Z","by":"analyst","doc":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","run_id":1465},"how_to_check":{"at":"2026-11-03T08:20:28Z","by":"analyst","doc":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","run_id":1465},"who_affected":{"at":"2026-11-03T08:20:28Z","by":"analyst","doc":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","run_id":1465}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apicontrolplane","apimanager","wso2apicontrolplane","wso2apimanager"],"ptokens":["api","control","manager","plane","wso2"],"labels":["critical","infrastructure","privilegeescalation","selfhosted","wso2","wso2apimanager","wso2identityserver"],"first_public_at":"2026-11-03T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-4052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4052","severity":null,"published_at":"2026-11-03T08:17:15+00:00","modified_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","fetched_at":"2026-11-03T08:19:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-4052:1465","url":null,"severity":null,"published_at":"2026-11-03T08:20:28+00:00","modified_at":"2026-11-03T08:20:28+00:00","first_seen_at":"2026-11-03T08:20:28+00:00","fetched_at":"2026-11-03T08:20:28+00:00","note":"Read WSO2-2026-5212 (vendor). Affected APIM 4.1.0-4.6.0 and API Control Plane 4.5.0/4.6.0, only with IS as Resident Key Manager + shared DB. Fix is update-level plus connector jar swap, no plain version number. No exploitation or PoC found. X not checked."}],"documents":[{"id":56478,"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","title":"WSO2-2026-5212 / CVE-2026-4052","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}