Wso2 Carbon Api Manager Rest Api Utility
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Wso2 Carbon Api Manager Rest Api Utility.
By the Year
In 2026 there have been 3 vulnerabilities in Wso2 Carbon Api Manager Rest Api Utility with an average score of 8.4 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 8.37 |
It may take a day or so for new Wso2 Carbon Api Manager Rest Api Utility vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Wso2 Carbon Api Manager Rest Api Utility Security Vulnerabilities
Tenant Isolation Bypass in WSO2 APIM Publisher APIs
CVE-2025-14561
9 - Critical
- August 06, 2026
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Authorization
WSO2 Identity Server: Low-Priv Token Enables Admin REST API Abuse
CVE-2026-1728
9.8 - Critical
- August 06, 2026
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Improper Privilege Management
WSO2 APIM 3.x RBAC Bypass in Gateway & Internal Service APIs
CVE-2025-8325
6.3 - Medium
- May 11, 2026
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
Improper Preservation of Permissions
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Wso2 Carbon Api Manager Rest Api Utility or by Wso2? Click the Watch button to subscribe.
