CVE-2025-10611

Published: Oct 16, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Description

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

Affected (41)

Products: Wso2: Api Control Plane, Api Manager, Identity Server, Identity Server As Key Manager, Open Banking Am, Open Banking Iam, Open Banking Km, Traffic Manager, Universal Gateway

9 products

Identity Server As Key Manager

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Control Plane	Version 4.5.0
Wso2 Api Manager	Version 2.1.0
Wso2 Api Manager	Version 2.2.0
Wso2 Api Manager	Version 2.5.0
Wso2 Api Manager	Version 2.6.0
Wso2 Api Manager	Version 3.0.0
Wso2 Api Manager	Version 3.1.0
Wso2 Api Manager	Version 3.2.0
Wso2 Api Manager	Version 3.2.1
Wso2 Api Manager	Version 4.0.0
Wso2 Api Manager	Version 4.1.0
Wso2 Api Manager	Version 4.2.0
Wso2 Api Manager	Version 4.3.0
Wso2 Api Manager	Version 4.4.0
Wso2 Api Manager	Version 4.5.0
Wso2 Identity Server	Version 5.10.0
Wso2 Identity Server	Version 5.11.0
Wso2 Identity Server	Version 5.3.0
Wso2 Identity Server	Version 5.5.0
Wso2 Identity Server	Version 5.6.0
Wso2 Identity Server	Version 5.7.0
Wso2 Identity Server	Version 5.8.0
Wso2 Identity Server	Version 5.9.0
Wso2 Identity Server	Version 6.0.0
Wso2 Identity Server	Version 6.1.0
Wso2 Identity Server	Version 7.0.0
Wso2 Identity Server	Version 7.1.0
Wso2 Identity Server As Key Manager	Version 5.10.0
Wso2 Identity Server As Key Manager	Version 5.3.0
Wso2 Identity Server As Key Manager	Version 5.5.0
Wso2 Identity Server As Key Manager	Version 5.6.0
Wso2 Identity Server As Key Manager	Version 5.7.0
Wso2 Identity Server As Key Manager	Version 5.9.0
Wso2 Open Banking Am	Version 1.4.0
Wso2 Open Banking Am	Version 1.5.0
Wso2 Open Banking Am	Version 2.0.0
Wso2 Open Banking Iam	Version 2.0.0
Wso2 Open Banking Km	Version 1.4.0
Wso2 Open Banking Km	Version 1.5.0
Wso2 Traffic Manager	Version 4.5.0
Wso2 Universal Gateway	Version 4.5.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

Timeline

No history available yet.