cveboard RSS feed

CVE-2025-10611

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.1.0UnavailableNone listed
2.1.0affectedcustom2.1.0.42UnavailableNone listed
2.2.0affectedcustom2.2.0.61UnavailableNone listed
2.5.0affectedcustom2.5.0.87UnavailableNone listed
2.6.0affectedcustom2.6.0.148UnavailableNone listed
3.0.0affectedcustom3.0.0.178UnavailableNone listed
3.1.0affectedcustom3.1.0.345UnavailableNone listed
3.2.0affectedcustom3.2.0.446UnavailableNone listed
3.2.1affectedcustom3.2.1.66UnavailableNone listed
4.0.0affectedcustom4.0.0.366UnavailableNone listed
4.1.0affectedcustom4.1.0.228UnavailableNone listed
4.2.0affectedcustom4.2.0.169UnavailableNone listed
4.3.0affectedcustom4.3.0.81UnavailableNone listed
4.4.0affectedcustom4.4.0.45UnavailableNone listed
4.5.0affectedcustom4.5.0.28UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.29UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.4.0UnavailableNone listed
1.4.0affectedcustom1.4.0.141UnavailableNone listed
1.5.0affectedcustom1.5.0.142UnavailableNone listed
2.0.0affectedcustom2.0.0.394UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.414UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.3.0UnavailableNone listed
5.3.0affectedcustom5.3.0.39UnavailableNone listed
5.5.0affectedcustom5.5.0.54UnavailableNone listed
5.6.0affectedcustom5.6.0.62UnavailableNone listed
5.7.0affectedcustom5.7.0.128UnavailableNone listed
5.8.0affectedcustom5.8.0.112UnavailableNone listed
5.9.0affectedcustom5.9.0.171UnavailableNone listed
5.10.0affectedcustom5.10.0.375UnavailableNone listed
5.11.0affectedcustom5.11.0.419UnavailableNone listed
6.0.0affectedcustom6.0.0.248UnavailableNone listed
6.1.0affectedcustom6.1.0.248UnavailableNone listed
7.0.0affectedcustom7.0.0.124UnavailableNone listed
7.1.0affectedcustom7.1.0.31UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.3.0UnavailableNone listed
5.3.0affectedcustom5.3.0.44UnavailableNone listed
5.5.0affectedcustom5.5.0.55UnavailableNone listed
5.6.0affectedcustom5.6.0.77UnavailableNone listed
5.7.0affectedcustom5.7.0.127UnavailableNone listed
5.9.0affectedcustom5.9.0.178UnavailableNone listed
5.10.0affectedcustom5.10.0.365UnavailableNone listed

WSO2 Open Banking KM

Vendor
WSO2
Product
WSO2 Open Banking KM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking KM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.4.0UnavailableNone listed
1.4.0affectedcustom1.4.0.135UnavailableNone listed
1.5.0affectedcustom1.5.0.125UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service

Vendor
WSO2
Product
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.1.1affectedcustom1.1.1.7UnavailableNone listed
1.1.16affectedcustom1.1.16.6UnavailableNone listed
1.1.18affectedcustom1.1.18.7UnavailableNone listed
1.1.20affectedcustom1.1.20.9UnavailableNone listed
1.1.26affectedcustom1.1.26.11UnavailableNone listed
1.3.6affectedcustom1.3.6.11UnavailableNone listed
1.4.0affectedcustom1.4.0.21UnavailableNone listed
1.4.25affectedcustom1.4.25.27UnavailableNone listed
1.4.52affectedcustom1.4.52.6UnavailableNone listed
1.6.1affectedcustom1.6.1.12UnavailableNone listed
1.7.1affectedcustom1.7.1.7UnavailableNone listed
1.8.11affectedcustom1.8.11.8UnavailableNone listed
1.8.41affectedcustom1.8.41.4UnavailableNone listed
1.9.4affectedcustom1.9.4.9UnavailableNone listed
1.9.18affectedcustom1.9.18.7UnavailableNone listed
1.8affectedcustom1.8.48UnavailableNone listed
1.9.46unaffectedcustomUnavailable*None listed

org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve

Vendor
WSO2
Product
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.1.1affectedcustom1.1.1.7UnavailableNone listed
1.1.16affectedcustom1.1.16.6UnavailableNone listed
1.1.18affectedcustom1.1.18.7UnavailableNone listed
1.1.20affectedcustom1.1.20.9UnavailableNone listed
1.1.26affectedcustom1.1.26.11UnavailableNone listed
1.3.6affectedcustom1.3.6.11UnavailableNone listed
1.4.0affectedcustom1.4.0.21UnavailableNone listed
1.4.25affectedcustom1.4.25.27UnavailableNone listed
1.4.52affectedcustom1.4.52.6UnavailableNone listed
1.6.1affectedcustom1.6.1.12UnavailableNone listed
1.7.1affectedcustom1.7.1.7UnavailableNone listed
1.8.11affectedcustom1.8.11.8UnavailableNone listed
1.8.41affectedcustom1.8.41.4UnavailableNone listed
1.9.4affectedcustom1.9.4.9UnavailableNone listed
1.9.18affectedcustom1.9.18.7UnavailableNone listed
1.8affectedcustom1.8.48UnavailableNone listed
1.9.46unaffectedcustomUnavailable*None listed