Access Control Flaw in WSO2 Product Enables Unauthorized API Scope Access
CVE-2025-11229

7.2HIGH

Key Information:

Vendor

Wso2

Status
Wso2 Identity Server
Wso2 Identity Application Management Component
Vendor
CVE Published:
4 November 2026

What is CVE-2025-11229?

A significant vulnerability exists within the WSO2 API Manager, allowing the unauthorized retrieval of all API scopes when the authorize_all_scopes configuration is enabled. This misconfiguration poses a serious risk, as it permits clients using the client credentials grant type to bypass essential access controls, potentially accessing sensitive data and executing unauthorized actions. In scenarios where this setting is not reverted to its secure default state, the exposure to privilege escalation and account takeover threats escalates, warranting immediate remediation and security practices.

Affected Version(s)

WSO2 Identity Application Management Component 7.0.78 < 7.0.78.137

WSO2 Identity Application Management Component 7.8.23 < 7.8.23.49

WSO2 Identity Server 7.0.0 < 7.0.0.125

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.