CVE-2025-9152
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Manager
- Vendor
- WSO2
- Product
- WSO2 API Manager
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | unknown | custom | 3.2.0 | Unavailable | None listed |
| 3.2.0 | affected | custom | 3.2.0.437 | Unavailable | None listed |
| 3.2.1 | affected | custom | 3.2.1.57 | Unavailable | None listed |
| 4.0.0 | affected | custom | 4.0.0.357 | Unavailable | None listed |
| 4.1.0 | affected | custom | 4.1.0.221 | Unavailable | None listed |
| 4.2.0 | affected | custom | 4.2.0.159 | Unavailable | None listed |
| 4.3.0 | affected | custom | 4.3.0.72 | Unavailable | None listed |
| 4.4.0 | affected | custom | 4.4.0.35 | Unavailable | None listed |
| 4.5.0 | affected | custom | 4.5.0.19 | Unavailable | None listed |
WSO2 API Control Plane
- Vendor
- WSO2
- Product
- WSO2 API Control Plane
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.5.0 | affected | custom | 4.5.0.20 | Unavailable | None listed |