Skip to content
Critical Access Control Flaw in WSO2 API Manager Disclosed

Critical Access Control Flaw in WSO2 API Manager Disclosed

First seen 2 Nov 2026, 14:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 19:47 UTC
  • •CVE-2025-11969 is rated critical with a CVSS score of 9.4.
  • •The vulnerability allows unauthorized administrative actions by low-privileged users.
  • •No known exploitation has been reported as of November 2, 2026.

WSO2 has disclosed CVE-2025-11969, a critical access control vulnerability in the System REST APIs of WSO2 API Manager and related products. This flaw allows users with low privileges to perform unauthorized actions, including executing administrative tasks. The vulnerability has a CVSS score of 9.4, indicating a critical severity level. WSO2's advisory was released on January 26, 2026, but the CVE record was only made public on November 2, 2026. As of now, there are no known exploitations or attacks related to this vulnerability. The affected products include WSO2 API Manager, Identity Server, and Open Banking AM and IAM products. WSO2 has provided fixes since January 2026, and any APIs created through the API Manager's API Gateway are not affected. The privilege requirement for exploitation remains unclear, as WSO2's documentation states low privileges are needed, while the CVSS vector indicates no privileges are required.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-26
WSO2 advisory released
WSO2 issued an advisory detailing CVE-2025-11969, providing fixes for affected products.
security.docs.wso2.com
2026-08-06
CVE-2026-5430 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-02
CVE-2025-11969 published
The CVE record for the access control flaw was made public, alerting users to the vulnerability.
Rescana

More articles in this cluster (5)

Following this threat?

Track CVE-2025-11969 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

Which WSO2 products are affected?
The vulnerability affects WSO2 API Manager, Identity Server, and related products.
Is there a patch available?
Yes, WSO2 has provided fixes since January 26, 2026.
What should I do if I'm using WSO2 products?
Apply the relevant fixes provided by WSO2 to mitigate the vulnerability.