Riskcovery

CVE-2025-10611

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

State
Published
Severity
9.8 Critical
Published
Oct 16, 2025
Updated
Oct 16, 2025
Reserved
Sep 17, 2025

Read the record on cve.org

Description

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.

Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWSO2

Weaknesses

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 2.1.0Unknown
  • 2.1.0 to before 2.1.0.42Affected
  • 2.2.0 to before 2.2.0.61Affected
  • 2.5.0 to before 2.5.0.87Affected
  • 2.6.0 to before 2.6.0.148Affected
  • 3.0.0 to before 3.0.0.178Affected
  • 3.1.0 to before 3.1.0.345Affected
  • 3.2.0 to before 3.2.0.446Affected
  • 3.2.1 to before 3.2.1.66Affected
  • 4.0.0 to before 4.0.0.366Affected
  • 4.1.0 to before 4.1.0.228Affected
  • 4.2.0 to before 4.2.0.169Affected
  • 4.3.0 to before 4.3.0.81Affected
  • 4.4.0 to before 4.4.0.45Affected
  • 4.5.0 to before 4.5.0.28Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.29Affected
WSO2 Open Banking AMWSO2
  • before 1.4.0Unknown
  • 1.4.0 to before 1.4.0.141Affected
  • 1.5.0 to before 1.5.0.142Affected
  • 2.0.0 to before 2.0.0.394Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.414Affected
WSO2 Identity ServerWSO2
  • before 5.3.0Unknown
  • 5.3.0 to before 5.3.0.39Affected
  • 5.5.0 to before 5.5.0.54Affected
  • 5.6.0 to before 5.6.0.62Affected
  • 5.7.0 to before 5.7.0.128Affected
  • 5.8.0 to before 5.8.0.112Affected
  • 5.9.0 to before 5.9.0.171Affected
  • 5.10.0 to before 5.10.0.375Affected
  • 5.11.0 to before 5.11.0.419Affected
  • 6.0.0 to before 6.0.0.248Affected
  • 6.1.0 to before 6.1.0.248Affected
  • 7.0.0 to before 7.0.0.124Affected
  • 7.1.0 to before 7.1.0.31Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.3.0Unknown
  • 5.3.0 to before 5.3.0.44Affected
  • 5.5.0 to before 5.5.0.55Affected
  • 5.6.0 to before 5.6.0.77Affected
  • 5.7.0 to before 5.7.0.127Affected
  • 5.9.0 to before 5.9.0.178Affected
  • 5.10.0 to before 5.10.0.365Affected
WSO2 Open Banking KMWSO2
  • before 1.4.0Unknown
  • 1.4.0 to before 1.4.0.135Affected
  • 1.5.0 to before 1.5.0.125Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.27Affected
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.serviceWSO2
  • 1.1.1 to before 1.1.1.7Affected
  • 1.1.16 to before 1.1.16.6Affected
  • 1.1.18 to before 1.1.18.7Affected
  • 1.1.20 to before 1.1.20.9Affected
  • 1.1.26 to before 1.1.26.11Affected
  • 1.3.6 to before 1.3.6.11Affected
  • 1.4.0 to before 1.4.0.21Affected
  • 1.4.25 to before 1.4.25.27Affected
  • 1.4.52 to before 1.4.52.6Affected
  • 1.6.1 to before 1.6.1.12Affected
  • 1.7.1 to before 1.7.1.7Affected
  • 1.8.11 to before 1.8.11.8Affected
  • 1.8.41 to before 1.8.41.4Affected
  • 1.9.4 to before 1.9.4.9Affected
  • 1.9.18 to before 1.9.18.7Affected
  • 1.8 to before 1.8.48Affected
  • 1.9.46 and laterNot affected
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valveWSO2
  • 1.1.1 to before 1.1.1.7Affected
  • 1.1.16 to before 1.1.16.6Affected
  • 1.1.18 to before 1.1.18.7Affected
  • 1.1.20 to before 1.1.20.9Affected
  • 1.1.26 to before 1.1.26.11Affected
  • 1.3.6 to before 1.3.6.11Affected
  • 1.4.0 to before 1.4.0.21Affected
  • 1.4.25 to before 1.4.25.27Affected
  • 1.4.52 to before 1.4.52.6Affected
  • 1.6.1 to before 1.6.1.12Affected
  • 1.7.1 to before 1.7.1.7Affected
  • 1.8.11 to before 1.8.11.8Affected
  • 1.8.41 to before 1.8.41.4Affected
  • 1.9.4 to before 1.9.4.9Affected
  • 1.9.18 to before 1.9.18.7Affected
  • 1.8 to before 1.8.48Affected
  • 1.9.46 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.