CVE-2025-11969 WSO2 API Manager - Broken Access Control

WSO2 API Manager contains a broken access control vulnerability caused by improper enforcement of access control mechanisms in System REST APIs, letting users with lower privileges perform unauthorized administrative actions, exploit requires access to System REST APIs.

CVSS base score 9.4 /10
Critical
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
View the NVD record ↗

Details

Type
Broken Access Control
Impact
Broken Access Control
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published
2 November 2026
Updated
3 November 2026
Weakness
CWE-285

Vendor fix

Update to the latest version of WSO2 API Manager where access control is properly enforced.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs