Threat level Severe
Contact
Critical 9.4
CVE-2025-11969

WSO2 API Manager — improper authorization.

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted.

WeaknessCWE-285: Improper authorization
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.4
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploit chance, 30 days
0.3%
Higher than 25% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.

Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

What to do

  1. 01Check whether you run WSO2 API Manager, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
WSO23 CVEs in 30 days
All WSO2 CVEs

Other CVEs in WSO2 API Manager

1 more CVE

All WSO2 API Manager CVEs
9.8WSO2 API Manager — missing authorization.EPSS 0.4%