{"id":"CVE-2025-10611","state":"PUBLISHED","title":"Potential Broken Access Control in Multiple WSO2 Products via System REST APIs","description":"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.","publishedAt":"2025-10-16T12:09:31.802Z","updatedAt":"2025-10-16T13:34:31.799Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 API Manager","WSO2 WSO2 API Control Plane","WSO2 WSO2 Open Banking AM","WSO2 WSO2 Open Banking IAM","WSO2 WSO2 Identity Server","WSO2 WSO2 Identity Server as Key Manager","WSO2 WSO2 Open Banking KM","WSO2 WSO2 Universal Gateway","WSO2 WSO2 Traffic Manager","WSO2 org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service","WSO2 org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve"],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.1.0","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.42","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.61","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.87","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.148","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.178","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.345","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.446","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.66","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.366","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.228","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.169","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.81","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.45","versionType":"custom"},{"version":"4.5.0","status":"affected","lessThan":"4.5.0.28","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.29","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.141","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.142","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.394","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.414","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.39","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.54","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.62","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.128","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.112","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.171","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.375","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.419","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.248","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.248","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.124","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.0.31","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.44","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.55","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.77","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.127","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.178","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.365","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.135","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.125","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.27","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.27","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service","packageName":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service","defaultStatus":"unknown","versions":[{"version":"1.1.1","status":"affected","lessThan":"1.1.1.7","versionType":"custom"},{"version":"1.1.16","status":"affected","lessThan":"1.1.16.6","versionType":"custom"},{"version":"1.1.18","status":"affected","lessThan":"1.1.18.7","versionType":"custom"},{"version":"1.1.20","status":"affected","lessThan":"1.1.20.9","versionType":"custom"},{"version":"1.1.26","status":"affected","lessThan":"1.1.26.11","versionType":"custom"},{"version":"1.3.6","status":"affected","lessThan":"1.3.6.11","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.21","versionType":"custom"},{"version":"1.4.25","status":"affected","lessThan":"1.4.25.27","versionType":"custom"},{"version":"1.4.52","status":"affected","lessThan":"1.4.52.6","versionType":"custom"},{"version":"1.6.1","status":"affected","lessThan":"1.6.1.12","versionType":"custom"},{"version":"1.7.1","status":"affected","lessThan":"1.7.1.7","versionType":"custom"},{"version":"1.8.11","status":"affected","lessThan":"1.8.11.8","versionType":"custom"},{"version":"1.8.41","status":"affected","lessThan":"1.8.41.4","versionType":"custom"},{"version":"1.9.4","status":"affected","lessThan":"1.9.4.9","versionType":"custom"},{"version":"1.9.18","status":"affected","lessThan":"1.9.18.7","versionType":"custom"},{"version":"1.8","status":"affected","lessThan":"1.8.48","versionType":"custom"},{"version":"1.9.46","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve","packageName":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve","defaultStatus":"unknown","versions":[{"version":"1.1.1","status":"affected","lessThan":"1.1.1.7","versionType":"custom"},{"version":"1.1.16","status":"affected","lessThan":"1.1.16.6","versionType":"custom"},{"version":"1.1.18","status":"affected","lessThan":"1.1.18.7","versionType":"custom"},{"version":"1.1.20","status":"affected","lessThan":"1.1.20.9","versionType":"custom"},{"version":"1.1.26","status":"affected","lessThan":"1.1.26.11","versionType":"custom"},{"version":"1.3.6","status":"affected","lessThan":"1.3.6.11","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.21","versionType":"custom"},{"version":"1.4.25","status":"affected","lessThan":"1.4.25.27","versionType":"custom"},{"version":"1.4.52","status":"affected","lessThan":"1.4.52.6","versionType":"custom"},{"version":"1.6.1","status":"affected","lessThan":"1.6.1.12","versionType":"custom"},{"version":"1.7.1","status":"affected","lessThan":"1.7.1.7","versionType":"custom"},{"version":"1.8.11","status":"affected","lessThan":"1.8.11.8","versionType":"custom"},{"version":"1.8.41","status":"affected","lessThan":"1.8.41.4","versionType":"custom"},{"version":"1.9.4","status":"affected","lessThan":"1.9.4.9","versionType":"custom"},{"version":"1.9.18","status":"affected","lessThan":"1.9.18.7","versionType":"custom"},{"version":"1.8","status":"affected","lessThan":"1.8.48","versionType":"custom"},{"version":"1.9.46","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10611.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10611","state":"PUBLISHED","datePublished":"2025-10-16T12:09:31.802Z","dateUpdated":"2025-10-16T13:34:31.799Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2025-09-17T08:56:27.794Z"},"containers":{"cna":{"title":"Potential Broken Access Control in Multiple WSO2 Products via System REST APIs","descriptions":[{"lang":"en","value":"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations."}],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.1.0","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.42","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.61","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.87","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.148","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.178","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.345","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.446","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.66","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.366","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.228","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.169","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.81","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.45","versionType":"custom"},{"version":"4.5.0","status":"affected","lessThan":"4.5.0.28","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.29","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.141","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.142","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.394","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.414","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.39","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.54","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.62","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.128","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.112","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.171","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.375","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.419","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.248","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.248","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.124","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.0.31","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.44","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.55","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.77","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.127","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.178","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.365","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.135","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.125","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.27","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.27","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service","packageName":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service","defaultStatus":"unknown","versions":[{"version":"1.1.1","status":"affected","lessThan":"1.1.1.7","versionType":"custom"},{"version":"1.1.16","status":"affected","lessThan":"1.1.16.6","versionType":"custom"},{"version":"1.1.18","status":"affected","lessThan":"1.1.18.7","versionType":"custom"},{"version":"1.1.20","status":"affected","lessThan":"1.1.20.9","versionType":"custom"},{"version":"1.1.26","status":"affected","lessThan":"1.1.26.11","versionType":"custom"},{"version":"1.3.6","status":"affected","lessThan":"1.3.6.11","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.21","versionType":"custom"},{"version":"1.4.25","status":"affected","lessThan":"1.4.25.27","versionType":"custom"},{"version":"1.4.52","status":"affected","lessThan":"1.4.52.6","versionType":"custom"},{"version":"1.6.1","status":"affected","lessThan":"1.6.1.12","versionType":"custom"},{"version":"1.7.1","status":"affected","lessThan":"1.7.1.7","versionType":"custom"},{"version":"1.8.11","status":"affected","lessThan":"1.8.11.8","versionType":"custom"},{"version":"1.8.41","status":"affected","lessThan":"1.8.41.4","versionType":"custom"},{"version":"1.9.4","status":"affected","lessThan":"1.9.4.9","versionType":"custom"},{"version":"1.9.18","status":"affected","lessThan":"1.9.18.7","versionType":"custom"},{"version":"1.8","status":"affected","lessThan":"1.8.48","versionType":"custom"},{"version":"1.9.46","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve","packageName":"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve","defaultStatus":"unknown","versions":[{"version":"1.1.1","status":"affected","lessThan":"1.1.1.7","versionType":"custom"},{"version":"1.1.16","status":"affected","lessThan":"1.1.16.6","versionType":"custom"},{"version":"1.1.18","status":"affected","lessThan":"1.1.18.7","versionType":"custom"},{"version":"1.1.20","status":"affected","lessThan":"1.1.20.9","versionType":"custom"},{"version":"1.1.26","status":"affected","lessThan":"1.1.26.11","versionType":"custom"},{"version":"1.3.6","status":"affected","lessThan":"1.3.6.11","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.21","versionType":"custom"},{"version":"1.4.25","status":"affected","lessThan":"1.4.25.27","versionType":"custom"},{"version":"1.4.52","status":"affected","lessThan":"1.4.52.6","versionType":"custom"},{"version":"1.6.1","status":"affected","lessThan":"1.6.1.12","versionType":"custom"},{"version":"1.7.1","status":"affected","lessThan":"1.7.1.7","versionType":"custom"},{"version":"1.8.11","status":"affected","lessThan":"1.8.11.8","versionType":"custom"},{"version":"1.8.41","status":"affected","lessThan":"1.8.41.4","versionType":"custom"},{"version":"1.9.4","status":"affected","lessThan":"1.9.4.9","versionType":"custom"},{"version":"1.9.18","status":"affected","lessThan":"1.9.18.7","versionType":"custom"},{"version":"1.8","status":"affected","lessThan":"1.8.48","versionType":"custom"},{"version":"1.9.46","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2025-10-16T12:09:31.802Z"},"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution</span></a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution"}],"source":{"advisory":"WSO2-2025-4585","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-16T13:24:33.931504Z","id":"CVE-2025-10611","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-16T13:34:31.799Z"}}]}}}