CVE-2026-1728

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

State: Published
Severity: 9.8 Critical
Published: Aug 6, 2026
Updated: Aug 6, 2026
Reserved: Jan 31, 2026

Description

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	WSO2

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 4.0.0Unknown 4.0.0 to before 4.0.0.384Affected 4.1.0 to before 4.1.0.248Affected 4.2.0 to before 4.2.0.188Affected 4.3.0 to before 4.3.0.99Affected 4.4.0 to before 4.4.0.63Affected 4.5.0 to before 4.5.0.48Affected 4.6.0 to before 4.6.0.12Affected
WSO2 API Control PlaneWSO2	4.5.0 to before 4.5.0.49Affected 4.6.0 to before 4.6.0.13Affected
WSO2 Universal GatewayWSO2	4.5.0 to before 4.5.0.48Affected 4.6.0 to before 4.6.0.12Affected
WSO2 Traffic ManagerWSO2	4.5.0 to before 4.5.0.47Affected 4.6.0 to before 4.6.0.12Affected
WSO2 Carbon API Manager Rest API Common FunctionsWSO2	9.0.174 to before 9.0.174.550Affected 9.28.116 to before 9.28.116.404Affected 9.29.120 to before 9.29.120.221Affected 9.30.67 to before 9.30.67.146Affected 9.31.86 to before 9.31.86.130Affected 9.32.147 to before 9.32.147.26Affected 9.33.27 and laterNot affected
WSO2 Carbon API Manager Rest API UtilityWSO2	9.20.74 to before 9.20.74.392Affected 9.33.27 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.