Input Validation Flaw in BPMN System REST APIs by WSO2
CVE-2026-78674

8.8HIGH

Key Information:

Vendor

Wso2

Status
Enterprise Integrator (bps Profile)
Business Process Server
Vendor
CVE Published:
28 October 2026

What is CVE-2026-78674?

The BPMN System REST APIs by WSO2 contain a significant input validation issue that permits authenticated users to send specially crafted requests. This flaw could allow these users to execute arbitrary commands on the server, leveraging the privileges associated with the runtime account of the product. The extent of the potential impact is determined by the permissions granted to this account. It is crucial that organizations using this system implement appropriate mitigation measures to protect against potential exploitation.

Affected Version(s)

Business Process Server 0 <= 3.6.0

Enterprise Integrator (BPS profile) 0 <= 6.6.0

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sanskaar pathak
.