InfoSec Signals™
Sign InStart Free
Back to CVE records
Critical 9.0Published Aug 6, 2026

CVE-2025-14561Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

Updated under an hour ago ()

Does this affect you?

It affects WSO2 API Manager and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS
9.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weakness (CWE)
CWE-284
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
WSO2
NVD analysis
Deferred
Record last updated
Aug 7, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
WSO2 WSO2 API Manager
wso2:api_manager (from the name)
from 4.1.0 before 4.1.0.242; from 4.2.0 before 4.2.0.182; from 4.3.0 before 4.3.0.93; from 4.4.0 before 4.4.0.57; from 4.5.0 before 4.5.0.41; from 4.6.0 before 4.6.0.6
CNA record
WSO2 WSO2 API Control Plane
wso2:api_control_plane (from the name)
from 4.5.0 before 4.5.0.42; from 4.6.0 before 4.6.0.7
CNA record
WSO2 WSO2 Traffic Manager
wso2:traffic_manager (from the name)
from 4.5.0 before 4.5.0.40; from 4.6.0 before 4.6.0.6
CNA record
WSO2 WSO2 Universal Gateway
wso2:universal_gateway (from the name)
from 4.5.0 before 4.5.0.40; from 4.6.0 before 4.6.0.6
CNA record
WSO2 WSO2 Carbon API Management Implementation
wso2:carbon_api_management_implementation (from the name)
from 9.20.74 before 9.20.74.388; from 9.28.116 before 9.28.116.395; from 9.29.120 before 9.29.120.213; from 9.30.67 before 9.30.67.135; from 9.31.86 before 9.31.86.108; from 9.32.147 before 9.32.147.5; from 9.32.160 not affected
CNA record
WSO2 WSO2 Carbon API Manager Rest API Utility
wso2:carbon_api_manager_rest_api_utility (from the name)
from 9.20.74 before 9.20.74.388; from 9.28.116 before 9.28.116.395; from 9.29.120 before 9.29.120.213; from 9.30.67 before 9.30.67.135; from 9.31.86 before 9.31.86.108; from 9.32.147 before 9.32.147.5; from 9.32.160 not affected
CNA record

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.