CVE-2025-10611criticalCWE-863

CVE-2025-10611: critical vulnerability in WSO2 org.wso2.carbon.identity.auth.rest:org.wso…

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Published

Follow this CVE+ Monitor WSO2 API Manager+ Monitor WSO2 Identity Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.8%
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
WSO2 · org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.serviceWSO2 · org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valveWSO2 · WSO2 API Control PlaneWSO2 · WSO2 API ManagerWSO2 · WSO2 Identity ServerWSO2 · WSO2 Identity Server as Key ManagerWSO2 · WSO2 Open Banking AMWSO2 · WSO2 Open Banking IAMWSO2 · WSO2 Open Banking KMWSO2 · WSO2 Traffic ManagerWSO2 · WSO2 Universal Gateway
Related CVEs — WSO2 org.wso2.carbon.identity.auth.rest:org.wso…

In the same product, most dangerous first.

CVE-2026-5430CRITICALAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverEPSS 22.4%KEVCVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-13590CRITICALAuthenticated arbitrary file upload via a System REST API requiring administrator permission.EPSS 0.8%CVE-2026-3418CRITICALArbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionEPSS 0.8%CVE-2025-9152CRITICALImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointEPSS 0.7%