1 vulnerability across 1 product scored HIGH or above on November 02, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] wso2/wso2_api_manager

1 CVE | CVSS 3.1: 9.4 | AAS 10.9

  • cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.3.0)

WSO2 API Manager contains a critical access control vulnerability (CVE-2025-11969, CVSS 9.4 HIGH) in its System REST APIs that allows lower-privileged users to escalate privileges and execute administrative operations that should be restricted to administrators. APIs exposed through the API Gateway are not affected, but the management plane is directly impacted.

Organizations running WSO2 API Manager should treat this as a high-priority patch. The flaw is considered exploitable, and because it requires only low-privilege authenticated access to abuse, the barrier to exploitation is minimal. Review the vendor advisory at security.docs.wso2.com and apply the recommended fix or mitigations immediately, particularly in environments where multiple users have any level of API Manager access.

Vendor Advisory