Executive brief
WSO2's API management products fail to properly isolate data between separate customer tenants in multi-tenant deployments. A privileged user in one tenant can exploit this to access and modify API metadata belonging to other tenants, potentially exposing sensitive configurations and allowing unauthorized API modifications across customer boundaries.
Technical details
The vulnerability is a cross-tenant access control bypass in the Publisher REST APIs, affecting only multi-tenant deployments. The root cause is insufficient tenant isolation enforcement in API access control logic. An authenticated user with sufficient privileges (e.g., API publisher role) in one tenant can invoke REST API endpoints that fail to validate tenant boundaries, allowing read and write operations on resources belonging to other tenants. No network-level authentication bypass is required—exploitation requires valid credentials and appropriate role permissions within the attacker's own tenant. Patches are available via GitHub PR #13546 and through WSO2 update subscriptions for all affected versions.
Affected products
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 Traffic Manager 4.5.0, 4.6.0
- WSO2 Universal Gateway 4.5.0, 4.6.0
Timeline
- 2026-01-26: disclosed