Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-9152

Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.2.0unknown
  • 3.2.0 to < 3.2.0.437affected
  • 3.2.1 to < 3.2.1.57affected
  • 4.0.0 to < 4.0.0.357affected
  • 4.1.0 to < 4.1.0.221affected
  • 4.2.0 to < 4.2.0.159affected
  • 4.3.0 to < 4.3.0.72affected
  • 4.4.0 to < 4.4.0.35affected
  • 4.5.0 to < 4.5.0.19affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.20affected

References