Executive brief
WSO2 API Manager and related components fail to properly restrict access to certain administrative and gateway interfaces. This allows any user with a basic account to perform sensitive operations that should be reserved for administrators, potentially leading to unauthorized configuration changes or service disruption. In older versions (3.x), this may also expose internal service interfaces to the public internet.
Technical details
An improper preservation of permissions (CWE-281) exists in the Gateway and Internal Service APIs of WSO2 API Manager and related products. The software fails to enforce role-based access controls (RBAC), allowing users with the 'Internal/Everyone' role to invoke sensitive REST API endpoints. An authenticated attacker with low privileges can bypass intended permission checks to perform sensitive operations against the Gateway REST API. In WSO2 APIM 3.x versions, this vulnerability also extends to Internal Service APIs which may be externally accessible. Fixes are available via WSO2 update levels or public GitHub pull requests for community users.
Affected products
- WSO2 API Manager 3.2.0 to 3.2.0.435, 3.2.1 to 3.2.1.55, 4.0.0 to 4.0.0.355, 4.1.0 to 4.1.0.219, 4.2.0 to 4.2.0.157, 4.3.0 to 4.3.0.70, 4.4.0 to 4.4.0.33, 4.5.0 to 4.5.0.17
- WSO2 API Control Plane 4.5.0 to 4.5.0.18
- WSO2 Traffic Manager 4.5.0 to 4.5.0.17
- WSO2 Universal Gateway 4.5.0 to 4.5.0.17
Timeline
- 2026-01-26: advisory: Initial vendor advisory published
- 2026-05-11: disclosed: CVE published to NVD