Access Control Vulnerability in WSO2 API Manager by WSO2
CVE-2025-11969

9.4CRITICAL

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Identity Server As Key Manager
Wso2 Open Banking Am
Wso2 Open Banking Iam
Vendor
CVE Published:
2 November 2026

What is CVE-2025-11969?

This vulnerability in WSO2 API Manager allows users with lower privilege roles to perform unauthorized administrative actions due to inadequate enforcement of access control mechanisms. As a result, these users can execute functions typically restricted to higher-privilege accounts. Importantly, the APIs exposed through the WSO2 API Manager's API Gateway remain unaffected by this flaw, accentuating the importance of secure API management practices.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.33

WSO2 API Manager 3.1.0 < 3.1.0.347

WSO2 API Manager 3.2.0 < 3.2.0.450

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.