CVE-2026-0637

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

En bref

Sévérité: MEDIUM 4.4
EPSS: EPSS 0.16 % · centile 5 (2026-10-27)
État: PUBLISHED
Publiée: 2026-08-06
Mise à jour: 2026-08-06
Attribuée par: WSO2
Statut NVD: Analyzed

Description

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	WSO2
CVSS 3.1	MEDIUM 4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Faiblesses (CWE)

CWE-532

Références européennes

ENISA EUVD · EUVD-2026-53820
GCVE · GCVE-0-2026-0637

Configurations affectées (CPE NVD)

cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* ≥ 4.5.0 < 4.5.0.50
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* ≥ 4.6.0 < 4.6.0.14
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 3.1.0 < 3.1.0.357
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.2.0.465
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 3.2.1 < 3.2.1.84
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.1.0 < 4.1.0.249
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.0.189
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.3.0 < 4.3.0.100
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.4.0 < 4.4.0.64
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.5.0 < 4.5.0.49
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* ≥ 4.6.0 < 4.6.0.13
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* ≥ 5.10.0 < 5.10.0.386
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* ≥ 5.11.0 < 5.11.0.433
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.0.260
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* ≥ 6.1.0 < 6.1.0.261
cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:* ≥ 5.10.0 < 5.10.0.377
cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.0.0.406
cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.0.0.426
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* ≥ 4.5.0 < 4.5.0.48
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* ≥ 4.6.0 < 4.6.0.13
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* ≥ 4.5.0 < 4.5.0.49
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* ≥ 4.6.0 < 4.6.0.13

Produits affectés

Produit	Versions
WSO2 · WSO2 API Manager	unknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.357 ; affected 3.2.0 < 3.2.0.465 ; affected 3.2.1 < 3.2.1.84 ; affected 4.1.0 < 4.1.0.249 ; affected 4.2.0 < 4.2.0.189
WSO2 · WSO2 Traffic Manager	unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.48 ; affected 4.6.0 < 4.6.0.13
WSO2 · WSO2 API Control Plane	unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.50 ; affected 4.6.0 < 4.6.0.14
WSO2 · WSO2 Universal Gateway	unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.49 ; affected 4.6.0 < 4.6.0.13
WSO2 · WSO2 Identity Server	unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.386 ; affected 5.11.0 < 5.11.0.433 ; affected 6.0.0 < 6.0.0.260 ; affected 6.1.0 < 6.1.0.261 ; affected 7.0.0 < 7.0.0.139
WSO2 · WSO2 Identity Server as Key Manager	unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.377
WSO2 · WSO2 Open Banking IAM	unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.426
WSO2 · WSO2 Open Banking AM	unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.406
WSO2 · WSO2 Carbon Event Publisher Core	affected 5.2.24 < 5.2.24.11 ; affected 5.2.26 < 5.2.26.24 ; affected 5.2.27 < 5.2.27.7 ; affected 5.2.41 < 5.2.41.8 ; affected 5.2.45 < 5.2.45.2 ; affected 5.2.50 < 5.2.50.3

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD