WSO2 API Manager CVE-2025-11969: System REST API Access Control Flaw Allows ...

TL;DR: WSO2 has disclosed CVE-2025-11969 (WSO2-2025-4733), a broken access control flaw in the System REST APIs of WSO2 API Manager and several related products, including Identity Server as Key Manager and the Open Banking AM and IAM products. WSO2 rates it Critical, CVSS 3.1 9.4 . In WSO2's words, "a user with low privileges can perform unauthorized actions, including executing administrative actions." WSO2's advisory is dated 26 January 2026 , and the fixed update levels have been out since then. The CVE record itself only went public on 2 November 2026 , so many teams are hearing it now ( WSO2 advisory ; CVE record ).

What we know and don't know (as of 2 November 2026):

No known exploitation. We found no reports of attacks. CVE-2025-11969 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog (catalog version 2026.10.30, checked 2 November 2026 at 13:12 Cyprus time, UTC+2).

The privilege requirement is unclear. WSO2's text says the attacker is "a user with low privileges". The CVSS vector WSO2 published scores it PR:N (no privileges required). WSO2 has not explained the gap, so plan for the worse case until it does.

APIs you publish are not in scope. WSO2 says "Any APIs created and exposed through the WSO2 API Manager's API Gateway remain unaffected."

Not the same as CVE-2026-5430. This is a different flaw from the WSO2 JWT authentication bypass (CVE-2026-5430, WSO2-2026-5328) that CISA added to KEV on 24 September 2026. We cover that one in our CVE-2026-5430 advisory .

Technical Information

WSO2's advisory gives a short description: "Due to improper access control in System REST APIs, a user with low privileges can perform unauthorized actions, including executing administrative actions." On impact, it says: "Successful exploitation of this vulnerability could allow a malicious actor to perform unauthorized operations on the affected product" ( WSO2 advisory, 26 January 2026 ).

The CVE record, which WSO2 filed as the CVE numbering authority, uses slightly different wording: "The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted." It classifies the bug as CWE-285 (Improper Authorization) and says WSO2 found it internally ( CVE record, 2 November 2026 ).

Scoring: CVSS 3.1 base score 9.4 (Critical) , vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L . That means it can be attacked over the network, with low complexity and no user interaction. The impact on confidentiality and integrity is high and the impact on availability is low. The vector also says no privileges are required (PR:N) , even though both of WSO2's descriptions talk lower-privileged users. We are quoting both as published and not resolving the mismatch. NVD lists the entry as "Received" and shows only WSO2's score so far, with no NVD score of its own ( NVD ). GitHub has published an unreviewed advisory, GHSA-p4rq-q6fh-965p, with the same text ( GitHub Advisory Database ).

What WSO2 has not said: It does not name the specific System REST API endpoints. It publishes no proof of concept and no detection guidance. We have not tried to reproduce the bug.

The public fix: WSO2 points open-source users to pull request wso2/carbon-apimgt#13521 . GitHub shows it was merged on 27 October 2025 under the title "Improve code", with no mention of a CVE. It changes shared REST API utility code and the configuration of the Gateway's REST API web app. Community users who track the upstream code may have missed it as a security fix.

Why the dates are confusing: The CVE ID carries the year 2025 (WSO2 reserved it on 20 October 2025). The advisory sits under a 2026 path on WSO2's site and is dated 26 January 2026. The CVE record went public on 2 November 2026. So subscription customers have had fixes for nine months, and the open-source fix has been public for a year.

Affected Product Versions

From the WSO2 advisory (26 January 2026), with the fixed WSO2 Updates level for subscription holders. WSO2 says to update to "the specified update level, or to a higher update level":

Notes from the CVE record ( CVE-2025-11969 ):

Versions older than the listed releases (for example, API Manager before 3.1.0) are marked "unknown" , not unaffected. Treat them as possibly affected and plan to migrate.

The record also lists the open-source components org.wso2.carbon.apimgt.rest.api.util and org.wso2.carbon.apimgt.rest.api.common . It marks them unaffected from version 9.32.147 .

Not affected: APIs created and exposed through the API Manager Gateway (WSO2's statement).

Workaround and Mitigation

WSO2 publishes no configuration workaround. Its guidance is:

Subscription holders: "Update your product to the specified update level, or to a higher update level" using WSO2 Updates. Then check the update level you are actually running against the table above.

Community (open-source) users: "Apply the relevant fixes to your product using the public fix(es) provided" ( PR #13521 ), or "If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s)."

Until you have patched (Rescana advice, not WSO2's):

Keep management interfaces off untrusted networks. Restrict who can reach the WSO2 management console and System REST API endpoints to admin networks or a VPN. The CVSS vector rates the flaw as reachable over the network, so exposure to the internet is what matters most.

Review accounts and roles. Remove unused low-privilege and self-signup accounts, and check who holds which roles. WSO2's description centres on lower-privileged users.

Prioritize open-banking and key-manager deployments. Identity Server as Key Manager and the Open Banking AM and IAM products handle tokens and consent. An unauthorized admin change there has a large blast radius.

Indicators of Compromise

WSO2 has not published any indicators of compromise, and we know of no attack activity to draw them from. After patching, owners of exposed deployments can still review:

Administrative changes (tenant, user, role, API, throttling or key-manager settings) made by accounts that do not hold admin roles.

Calls to admin or System REST APIs from source addresses outside your known management hosts, in the WSO2 audit and HTTP access logs.

New or changed users, roles, applications or OAuth clients that have no matching change record.

We will add IoCs here if WSO2 or a credible researcher publishes them.

We will update this post if:

CISA's KEV catalog starts listing CVE-2025-11969, or exploitation is reported.

WSO2 revises the advisory (currently version 1.0.0) or explains the privilege wording versus PR:N.

NVD adds its own score, or a public proof of concept appears.

What to do with this vendor today

WSO2 API Manager, Identity Server as Key Manager and the Open Banking products usually sit inside your suppliers, not on your own network. Think of fintech and open-banking providers, banks' partner API platforms, payment processors, API-management and integration service providers, and SaaS vendors that expose partner APIs. If one of them still runs a System REST API without the fix, someone could make admin-level changes to the platform that brokers your API traffic, tokens or consents.

Questions to send today to critical vendors and fintech or open-banking providers:

Do you run WSO2 API Manager (3.1.0 to 4.5.0), API Control Plane, Traffic Manager or Universal Gateway 4.5.0, Identity Server as Key Manager 5.10.0, or Open Banking AM or IAM 2.0.0 in any environment that handles our data or traffic?

Can those products' System REST APIs or management endpoints be reached from untrusted networks or the internet?

Which WSO2 Updates level are you on, or have you applied PR #13521? If you are below the fixed level, when will you patch?

Have you reviewed administrative changes made by non-admin accounts since the advisory came out in January 2026?

Record the answers and the date. Ask again if CISA's KEV catalog starts listing CVE-2025-11969 or attacks are reported.

Forward this to your TPRM owner: CVE-2025-11969 (CVSS 9.4) is a broken access control flaw in the System REST APIs of WSO2 API Manager, Identity Server as Key Manager and the Open Banking AM and IAM products. WSO2 says lower-privileged users can run admin actions, but its CVSS vector says no privileges are required. No exploitation is known and it is not in CISA KEV. Fixes have been out since January 2026. Ask fintech, open-banking and API-platform suppliers whether they run these products and which update level they are on.

Need help working through API-platform and open-banking suppliers exposed to CVE-2025-11969? Our team can help you prioritize them and track their answers.

WSO2: Security Advisory WSO2-2025-4733 / CVE-2025-11969 (published 26 January 2026, version 1.0.0):

WSO2 public fix: wso2/carbon-apimgt pull request #13521, "Improve code" (merged 27 October 2025):

CVE record: CVE-2025-11969 (CNA WSO2, published 2 November 2026):

NVD: CVE-2025-11969 (published 2 November 2026, status Received):

GitHub Advisory Database: GHSA-p4rq-q6fh-965p (unreviewed, 2 November 2026):

CISA: KEV catalog (version 2026.10.30, checked 2 November 2026):