CVE-2025-14561
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
At a glance
- Severity
- CRITICAL 9.0
- EPSS
- EPSS 0.41 % · percentile 35 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Deferred
Description
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L | WSO2 |
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2025-210647
- GCVE · GCVE-0-2025-14561
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 API Manager | affected 4.1.0 < 4.1.0.242 ; affected 4.2.0 < 4.2.0.182 ; affected 4.3.0 < 4.3.0.93 ; affected 4.4.0 < 4.4.0.57 ; affected 4.5.0 < 4.5.0.41 ; affected 4.6.0 < 4.6.0.6 |
| WSO2 · WSO2 API Control Plane | affected 4.5.0 < 4.5.0.42 ; affected 4.6.0 < 4.6.0.7 |
| WSO2 · WSO2 Traffic Manager | affected 4.5.0 < 4.5.0.40 ; affected 4.6.0 < 4.6.0.6 |
| WSO2 · WSO2 Universal Gateway | affected 4.5.0 < 4.5.0.40 ; affected 4.6.0 < 4.6.0.6 |
| WSO2 · WSO2 Carbon API Management Implementation | affected 9.20.74 < 9.20.74.388 ; affected 9.28.116 < 9.28.116.395 ; affected 9.29.120 < 9.29.120.213 ; affected 9.30.67 < 9.30.67.135 ; affected 9.31.86 < 9.31.86.108 ; affected 9.32.147 < 9.32.147.5 |
| WSO2 · WSO2 Carbon API Manager Rest API Utility | affected 9.20.74 < 9.20.74.388 ; affected 9.28.116 < 9.28.116.395 ; affected 9.29.120 < 9.29.120.213 ; affected 9.30.67 < 9.30.67.135 ; affected 9.31.86 < 9.31.86.108 ; affected 9.32.147 < 9.32.147.5 |
References
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |