Executive brief
WSO2 Identity Server and API Manager are used to manage user identities and secure access to applications. A flaw in how these systems handle user permissions in multi-tenant environments (where multiple organizations share the same infrastructure) could allow an application in one organization to inherit permissions granted in another if they share the same name. This could lead to unauthorized access to user data and privacy violations across different business units or customers.
Technical details
A vulnerability in the application consent management mechanism of WSO2 Identity Server and API Manager leads to improper isolation of consent scopes in multi-tenant deployments. When a user grants consent to a SaaS application in one tenant, that consent may be incorrectly applied to applications with the identical name in other tenants. This is classified as an authentication bypass via an alternate path (CWE-288). An attacker with low privileges could potentially exploit this to access or modify user data across tenant boundaries, provided the deployment is configured for multi-tenancy and a user interacts with the application. Fixes are available via specific product updates which require manual database table additions (IDN_OAUTH2_USER_CONSENT and IDN_OAUTH2_USER_CONSENTED_SCOPES) after patching.
Affected products
- WSO2 Identity Server 5.10.0 before update 382
- WSO2 API Manager 3.2.0 before update 457, 3.2.1 before update 76
Timeline
- 2026-06-18: advisory: Initial advisory published by WSO2
- 2026-07-04: disclosed: CVE published to NVD dataset