Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-0637

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

At a glance

Severity
MEDIUM 4.4
EPSS
EPSS 0.16 % · percentile 5 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
WSO2
NVD status
Analyzed

Description

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NWSO2
CVSS 3.1MEDIUM 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Weaknesses (CWE)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
WSO2 · WSO2 API Managerunknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.357 ; affected 3.2.0 < 3.2.0.465 ; affected 3.2.1 < 3.2.1.84 ; affected 4.1.0 < 4.1.0.249 ; affected 4.2.0 < 4.2.0.189
WSO2 · WSO2 Traffic Managerunknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.48 ; affected 4.6.0 < 4.6.0.13
WSO2 · WSO2 API Control Planeunknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.50 ; affected 4.6.0 < 4.6.0.14
WSO2 · WSO2 Universal Gatewayunknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.49 ; affected 4.6.0 < 4.6.0.13
WSO2 · WSO2 Identity Serverunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.386 ; affected 5.11.0 < 5.11.0.433 ; affected 6.0.0 < 6.0.0.260 ; affected 6.1.0 < 6.1.0.261 ; affected 7.0.0 < 7.0.0.139
WSO2 · WSO2 Identity Server as Key Managerunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.377
WSO2 · WSO2 Open Banking IAMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.426
WSO2 · WSO2 Open Banking AMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.406
WSO2 · WSO2 Carbon Event Publisher Coreaffected 5.2.24 < 5.2.24.11 ; affected 5.2.26 < 5.2.26.24 ; affected 5.2.27 < 5.2.27.7 ; affected 5.2.41 < 5.2.41.8 ; affected 5.2.45 < 5.2.45.2 ; affected 5.2.50 < 5.2.50.3

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD