CVE-2025-10611criticalCWE-863

CVE-2025-10611: falha crítica em WSO2 org.wso2.carbon.identity.auth.rest:org.wso…

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Publicada em

Seguir esta CVE+ Monitorar WSO2 API Manager+ Monitorar WSO2 Identity Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.8%
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
WSO2 · org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.serviceWSO2 · org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valveWSO2 · WSO2 API Control PlaneWSO2 · WSO2 API ManagerWSO2 · WSO2 Identity ServerWSO2 · WSO2 Identity Server as Key ManagerWSO2 · WSO2 Open Banking AMWSO2 · WSO2 Open Banking IAMWSO2 · WSO2 Open Banking KMWSO2 · WSO2 Traffic ManagerWSO2 · WSO2 Universal Gateway
CVEs relacionadas — WSO2 org.wso2.carbon.identity.auth.rest:org.wso…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5430CRITICALAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverEPSS 22.4%KEVCVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-13590CRITICALAuthenticated arbitrary file upload via a System REST API requiring administrator permission.EPSS 0.8%CVE-2026-3418CRITICALArbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionEPSS 0.8%CVE-2025-9152CRITICALImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointEPSS 0.7%