CVE-2025-14561: Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-09-29
Weakness: CWE-284

Description

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Affected products

WSO2 API Manager: from 4.1.0 before 4.1.0.242; from 4.2.0 before 4.2.0.182; from 4.3.0 before 4.3.0.93; from 4.4.0 before 4.4.0.57; from 4.5.0 before 4.5.0.41; from 4.6.0 before 4.6.0.6 — fixed in 4.1.0.242, 4.2.0.182, 4.3.0.93, 4.4.0.57, 4.5.0.41, 4.6.0.6
WSO2 API Control Plane: from 4.5.0 before 4.5.0.42; from 4.6.0 before 4.6.0.7 — fixed in 4.5.0.42, 4.6.0.7
WSO2 Carbon API Management Implementation: from 9.20.74 before 9.20.74.388; from 9.28.116 before 9.28.116.395; from 9.29.120 before 9.29.120.213; from 9.30.67 before 9.30.67.135; from 9.31.86 before 9.31.86.108; from 9.32.147 before 9.32.147.5 — fixed in 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5
WSO2 Carbon API Manager Rest API Utility: from 9.20.74 before 9.20.74.388; from 9.28.116 before 9.28.116.395; from 9.29.120 before 9.29.120.213; from 9.30.67 before 9.30.67.135; from 9.31.86 before 9.31.86.108; from 9.32.147 before 9.32.147.5 — fixed in 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5
WSO2 Traffic Manager: from 4.5.0 before 4.5.0.40; from 4.6.0 before 4.6.0.6 — fixed in 4.5.0.40, 4.6.0.6
WSO2 Universal Gateway: from 4.5.0 before 4.5.0.40; from 4.6.0 before 4.6.0.6 — fixed in 4.5.0.40, 4.6.0.6

How to fix

Upgrade to a fixed version: WSO2 API Manager 4.1.0.242, 4.2.0.182, 4.3.0.93, 4.4.0.57; WSO2 API Control Plane 4.5.0.42, 4.6.0.7; WSO2 Carbon API Management Implementation 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135; WSO2 Carbon API Manager Rest API Utility 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135; WSO2 Traffic Manager 4.5.0.40, 4.6.0.6; WSO2 Universal Gateway 4.5.0.40, 4.6.0.6. Check the vendor advisory for mitigations.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/

Get alerted when CVE-2025-14561 or the next vulnerability affects your stack