CVE-2025-14561

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

State: Published
Severity: 9.0 Critical
Published: Aug 6, 2026
Updated: Aug 7, 2026
Reserved: Dec 12, 2025

Description

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.

The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L	WSO2

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
WSO2 API ManagerWSO2	4.1.0 to before 4.1.0.242Affected 4.2.0 to before 4.2.0.182Affected 4.3.0 to before 4.3.0.93Affected 4.4.0 to before 4.4.0.57Affected 4.5.0 to before 4.5.0.41Affected 4.6.0 to before 4.6.0.6Affected
WSO2 API Control PlaneWSO2	4.5.0 to before 4.5.0.42Affected 4.6.0 to before 4.6.0.7Affected
WSO2 Traffic ManagerWSO2	4.5.0 to before 4.5.0.40Affected 4.6.0 to before 4.6.0.6Affected
WSO2 Universal GatewayWSO2	4.5.0 to before 4.5.0.40Affected 4.6.0 to before 4.6.0.6Affected
WSO2 Carbon API Management ImplementationWSO2	9.20.74 to before 9.20.74.388Affected 9.28.116 to before 9.28.116.395Affected 9.29.120 to before 9.29.120.213Affected 9.30.67 to before 9.30.67.135Affected 9.31.86 to before 9.31.86.108Affected 9.32.147 to before 9.32.147.5Affected 9.32.160 and laterNot affected
WSO2 Carbon API Manager Rest API UtilityWSO2	9.20.74 to before 9.20.74.388Affected 9.28.116 to before 9.28.116.395Affected 9.29.120 to before 9.29.120.213Affected 9.30.67 to before 9.30.67.135Affected 9.31.86 to before 9.31.86.108Affected 9.32.147 to before 9.32.147.5Affected 9.32.160 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.