CVE-2025-10611 (GCVE-0-2025-10611)
Vulnerability from cvelistv5 – Published: 2025-10-16 12:09 – Updated: 2025-10-16 13:34
VLAI
Title
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Summary
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.
Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 2.1.0
(custom)
Affected: 2.1.0 , < 2.1.0.42 (custom) Affected: 2.2.0 , < 2.2.0.61 (custom) Affected: 2.5.0 , < 2.5.0.87 (custom) Affected: 2.6.0 , < 2.6.0.148 (custom) Affected: 3.0.0 , < 3.0.0.178 (custom) Affected: 3.1.0 , < 3.1.0.345 (custom) Affected: 3.2.0 , < 3.2.0.446 (custom) Affected: 3.2.1 , < 3.2.1.66 (custom) Affected: 4.0.0 , < 4.0.0.366 (custom) Affected: 4.1.0 , < 4.1.0.228 (custom) Affected: 4.2.0 , < 4.2.0.169 (custom) Affected: 4.3.0 , < 4.3.0.81 (custom) Affected: 4.4.0 , < 4.4.0.45 (custom) Affected: 4.5.0 , < 4.5.0.28 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.29
(custom)
|
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 1.4.0
(custom)
Affected: 1.4.0 , < 1.4.0.141 (custom) Affected: 1.5.0 , < 1.5.0.142 (custom) Affected: 2.0.0 , < 2.0.0.394 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.414 (custom) |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.3.0
(custom)
Affected: 5.3.0 , < 5.3.0.39 (custom) Affected: 5.5.0 , < 5.5.0.54 (custom) Affected: 5.6.0 , < 5.6.0.62 (custom) Affected: 5.7.0 , < 5.7.0.128 (custom) Affected: 5.8.0 , < 5.8.0.112 (custom) Affected: 5.9.0 , < 5.9.0.171 (custom) Affected: 5.10.0 , < 5.10.0.375 (custom) Affected: 5.11.0 , < 5.11.0.419 (custom) Affected: 6.0.0 , < 6.0.0.248 (custom) Affected: 6.1.0 , < 6.1.0.248 (custom) Affected: 7.0.0 , < 7.0.0.124 (custom) Affected: 7.1.0 , < 7.1.0.31 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.3.0
(custom)
Affected: 5.3.0 , < 5.3.0.44 (custom) Affected: 5.5.0 , < 5.5.0.55 (custom) Affected: 5.6.0 , < 5.6.0.77 (custom) Affected: 5.7.0 , < 5.7.0.127 (custom) Affected: 5.9.0 , < 5.9.0.178 (custom) Affected: 5.10.0 , < 5.10.0.365 (custom) |
|
| WSO2 | WSO2 Open Banking KM |
Unknown:
0 , < 1.4.0
(custom)
Affected: 1.4.0 , < 1.4.0.135 (custom) Affected: 1.5.0 , < 1.5.0.125 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.27
(custom)
|
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.27
(custom)
|
|
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service |
Affected:
1.1.1 , < 1.1.1.7
(custom)
Affected: 1.1.16 , < 1.1.16.6 (custom) Affected: 1.1.18 , < 1.1.18.7 (custom) Affected: 1.1.20 , < 1.1.20.9 (custom) Affected: 1.1.26 , < 1.1.26.11 (custom) Affected: 1.3.6 , < 1.3.6.11 (custom) Affected: 1.4.0 , < 1.4.0.21 (custom) Affected: 1.4.25 , < 1.4.25.27 (custom) Affected: 1.4.52 , < 1.4.52.6 (custom) Affected: 1.6.1 , < 1.6.1.12 (custom) Affected: 1.7.1 , < 1.7.1.7 (custom) Affected: 1.8.11 , < 1.8.11.8 (custom) Affected: 1.8.41 , < 1.8.41.4 (custom) Affected: 1.9.4 , < 1.9.4.9 (custom) Affected: 1.9.18 , < 1.9.18.7 (custom) Affected: 1.8 , < 1.8.48 (custom) Unaffected: 1.9.46 , ≤ * (custom) |
|
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve |
Affected:
1.1.1 , < 1.1.1.7
(custom)
Affected: 1.1.16 , < 1.1.16.6 (custom) Affected: 1.1.18 , < 1.1.18.7 (custom) Affected: 1.1.20 , < 1.1.20.9 (custom) Affected: 1.1.26 , < 1.1.26.11 (custom) Affected: 1.3.6 , < 1.3.6.11 (custom) Affected: 1.4.0 , < 1.4.0.21 (custom) Affected: 1.4.25 , < 1.4.25.27 (custom) Affected: 1.4.52 , < 1.4.52.6 (custom) Affected: 1.6.1 , < 1.6.1.12 (custom) Affected: 1.7.1 , < 1.7.1.7 (custom) Affected: 1.8.11 , < 1.8.11.8 (custom) Affected: 1.8.41 , < 1.8.41.4 (custom) Affected: 1.9.4 , < 1.9.4.9 (custom) Affected: 1.9.18 , < 1.9.18.7 (custom) Affected: 1.8 , < 1.8.48 (custom) Unaffected: 1.9.46 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-16T13:24:33.931504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-16T13:34:31.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.1.0.42",
"status": "affected",
"version": "2.1.0",
"versionType": "custom"
},
{
"lessThan": "2.2.0.61",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
},
{
"lessThan": "2.5.0.87",
"status": "affected",
"version": "2.5.0",
"versionType": "custom"
},
{
"lessThan": "2.6.0.148",
"status": "affected",
"version": "2.6.0",
"versionType": "custom"
},
{
"lessThan": "3.0.0.178",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.345",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.446",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.66",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.366",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.228",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.169",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.81",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.45",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.28",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.29",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.4.0.141",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.5.0.142",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.394",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.3.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.3.0.39",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
},
{
"lessThan": "5.5.0.54",
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "5.6.0.62",
"status": "affected",
"version": "5.6.0",
"versionType": "custom"
},
{
"lessThan": "5.7.0.128",
"status": "affected",
"version": "5.7.0",
"versionType": "custom"
},
{
"lessThan": "5.8.0.112",
"status": "affected",
"version": "5.8.0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.171",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.375",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.419",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.248",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.248",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.124",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.31",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.3.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.3.0.44",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
},
{
"lessThan": "5.5.0.55",
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "5.6.0.77",
"status": "affected",
"version": "5.6.0",
"versionType": "custom"
},
{
"lessThan": "5.7.0.127",
"status": "affected",
"version": "5.7.0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.178",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.365",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking KM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.4.0.135",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.5.0.125",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service",
"product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.1.1.7",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.16.6",
"status": "affected",
"version": "1.1.16",
"versionType": "custom"
},
{
"lessThan": "1.1.18.7",
"status": "affected",
"version": "1.1.18",
"versionType": "custom"
},
{
"lessThan": "1.1.20.9",
"status": "affected",
"version": "1.1.20",
"versionType": "custom"
},
{
"lessThan": "1.1.26.11",
"status": "affected",
"version": "1.1.26",
"versionType": "custom"
},
{
"lessThan": "1.3.6.11",
"status": "affected",
"version": "1.3.6",
"versionType": "custom"
},
{
"lessThan": "1.4.0.21",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.25.27",
"status": "affected",
"version": "1.4.25",
"versionType": "custom"
},
{
"lessThan": "1.4.52.6",
"status": "affected",
"version": "1.4.52",
"versionType": "custom"
},
{
"lessThan": "1.6.1.12",
"status": "affected",
"version": "1.6.1",
"versionType": "custom"
},
{
"lessThan": "1.7.1.7",
"status": "affected",
"version": "1.7.1",
"versionType": "custom"
},
{
"lessThan": "1.8.11.8",
"status": "affected",
"version": "1.8.11",
"versionType": "custom"
},
{
"lessThan": "1.8.41.4",
"status": "affected",
"version": "1.8.41",
"versionType": "custom"
},
{
"lessThan": "1.9.4.9",
"status": "affected",
"version": "1.9.4",
"versionType": "custom"
},
{
"lessThan": "1.9.18.7",
"status": "affected",
"version": "1.9.18",
"versionType": "custom"
},
{
"lessThan": "1.8.48",
"status": "affected",
"version": "1.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.9.46",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve",
"product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.1.1.7",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.16.6",
"status": "affected",
"version": "1.1.16",
"versionType": "custom"
},
{
"lessThan": "1.1.18.7",
"status": "affected",
"version": "1.1.18",
"versionType": "custom"
},
{
"lessThan": "1.1.20.9",
"status": "affected",
"version": "1.1.20",
"versionType": "custom"
},
{
"lessThan": "1.1.26.11",
"status": "affected",
"version": "1.1.26",
"versionType": "custom"
},
{
"lessThan": "1.3.6.11",
"status": "affected",
"version": "1.3.6",
"versionType": "custom"
},
{
"lessThan": "1.4.0.21",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.25.27",
"status": "affected",
"version": "1.4.25",
"versionType": "custom"
},
{
"lessThan": "1.4.52.6",
"status": "affected",
"version": "1.4.52",
"versionType": "custom"
},
{
"lessThan": "1.6.1.12",
"status": "affected",
"version": "1.6.1",
"versionType": "custom"
},
{
"lessThan": "1.7.1.7",
"status": "affected",
"version": "1.7.1",
"versionType": "custom"
},
{
"lessThan": "1.8.11.8",
"status": "affected",
"version": "1.8.11",
"versionType": "custom"
},
{
"lessThan": "1.8.41.4",
"status": "affected",
"version": "1.8.41",
"versionType": "custom"
},
{
"lessThan": "1.9.4.9",
"status": "affected",
"version": "1.9.4",
"versionType": "custom"
},
{
"lessThan": "1.9.18.7",
"status": "affected",
"version": "1.9.18",
"versionType": "custom"
},
{
"lessThan": "1.8.48",
"status": "affected",
"version": "1.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.9.46",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\u003cbr\u003e"
}
],
"value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-16T12:09:31.802Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4585",
"discovery": "INTERNAL"
},
"title": "Potential Broken Access Control in Multiple WSO2 Products via System REST APIs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-10611",
"datePublished": "2025-10-16T12:09:31.802Z",
"dateReserved": "2025-09-17T08:56:27.794Z",
"dateUpdated": "2025-10-16T13:34:31.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-10611",
"date": "2026-06-27",
"epss": "0.00783",
"percentile": "0.51431"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-10611\",\"sourceIdentifier\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"published\":\"2025-10-16T13:15:40.640\",\"lastModified\":\"2026-06-17T08:28:37.350\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\\n\\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\"}],\"affected\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"affectedData\":[{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.1.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"2.1.0\",\"lessThan\":\"2.1.0.42\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.2.0\",\"lessThan\":\"2.2.0.61\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.5.0\",\"lessThan\":\"2.5.0.87\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.6.0\",\"lessThan\":\"2.6.0.148\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.0.0\",\"lessThan\":\"3.0.0.178\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.1.0\",\"lessThan\":\"3.1.0.345\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.2.0\",\"lessThan\":\"3.2.0.446\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.2.1\",\"lessThan\":\"3.2.1.66\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.0.0\",\"lessThan\":\"4.0.0.366\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.1.0\",\"lessThan\":\"4.1.0.228\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.2.0\",\"lessThan\":\"4.2.0.169\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.3.0\",\"lessThan\":\"4.3.0.81\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.4.0\",\"lessThan\":\"4.4.0.45\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.28\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Control Plane\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.29\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Open Banking AM\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.4.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"1.4.0\",\"lessThan\":\"1.4.0.141\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.5.0\",\"lessThan\":\"1.5.0.142\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.0.0\",\"lessThan\":\"2.0.0.394\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Open Banking IAM\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.0.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"2.0.0\",\"lessThan\":\"2.0.0.414\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Identity Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.3.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"5.3.0\",\"lessThan\":\"5.3.0.39\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.5.0\",\"lessThan\":\"5.5.0.54\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.6.0\",\"lessThan\":\"5.6.0.62\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.7.0\",\"lessThan\":\"5.7.0.128\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.8.0\",\"lessThan\":\"5.8.0.112\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.9.0\",\"lessThan\":\"5.9.0.171\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.10.0\",\"lessThan\":\"5.10.0.375\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.11.0\",\"lessThan\":\"5.11.0.419\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.0.0\",\"lessThan\":\"6.0.0.248\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.1.0\",\"lessThan\":\"6.1.0.248\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.0.0\",\"lessThan\":\"7.0.0.124\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"lessThan\":\"7.1.0.31\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Identity Server as Key Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.3.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"5.3.0\",\"lessThan\":\"5.3.0.44\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.5.0\",\"lessThan\":\"5.5.0.55\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.6.0\",\"lessThan\":\"5.6.0.77\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.7.0\",\"lessThan\":\"5.7.0.127\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.9.0\",\"lessThan\":\"5.9.0.178\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.10.0\",\"lessThan\":\"5.10.0.365\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Open Banking KM\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.4.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"1.4.0\",\"lessThan\":\"1.4.0.135\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.5.0\",\"lessThan\":\"1.5.0.125\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Universal Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.27\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Traffic Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.27\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\",\"defaultStatus\":\"unknown\",\"packageName\":\"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\",\"versions\":[{\"version\":\"1.1.1\",\"lessThan\":\"1.1.1.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.16\",\"lessThan\":\"1.1.16.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.18\",\"lessThan\":\"1.1.18.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.20\",\"lessThan\":\"1.1.20.9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.26\",\"lessThan\":\"1.1.26.11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.3.6\",\"lessThan\":\"1.3.6.11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.0\",\"lessThan\":\"1.4.0.21\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.25\",\"lessThan\":\"1.4.25.27\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.52\",\"lessThan\":\"1.4.52.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.6.1\",\"lessThan\":\"1.6.1.12\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.7.1\",\"lessThan\":\"1.7.1.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8.11\",\"lessThan\":\"1.8.11.8\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8.41\",\"lessThan\":\"1.8.41.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.4\",\"lessThan\":\"1.9.4.9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.18\",\"lessThan\":\"1.9.18.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8\",\"lessThan\":\"1.8.48\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.46\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"WSO2\",\"product\":\"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\",\"defaultStatus\":\"unknown\",\"packageName\":\"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\",\"versions\":[{\"version\":\"1.1.1\",\"lessThan\":\"1.1.1.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.16\",\"lessThan\":\"1.1.16.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.18\",\"lessThan\":\"1.1.18.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.20\",\"lessThan\":\"1.1.20.9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.1.26\",\"lessThan\":\"1.1.26.11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.3.6\",\"lessThan\":\"1.3.6.11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.0\",\"lessThan\":\"1.4.0.21\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.25\",\"lessThan\":\"1.4.25.27\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.4.52\",\"lessThan\":\"1.4.52.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.6.1\",\"lessThan\":\"1.6.1.12\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.7.1\",\"lessThan\":\"1.7.1.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8.11\",\"lessThan\":\"1.8.11.8\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8.41\",\"lessThan\":\"1.8.41.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.4\",\"lessThan\":\"1.9.4.9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.18\",\"lessThan\":\"1.9.18.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.8\",\"lessThan\":\"1.8.48\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.9.46\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-16T13:24:33.931504Z\",\"id\":\"CVE-2025-10611\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"245D4EB1-F69D-4FAF-94DB-F4B3D3C20539\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6819491F-C6C3-41C1-B27A-0D0B62224977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D57C8CF-084D-4142-9AF1-7C9F1261A3BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC168B6A-B15A-4C3B-A38D-C0B65F24F333\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FF14774-8935-4FC9-B5C8-9771B3D6EBFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1344FB79-0796-445C-A8F3-C03E995925D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E31E32CD-497E-4EF5-B3FC-8718EE06EDAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B58251E8-606B-47C8-8E50-9F9FC8C179BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E21D7ABF-C328-425D-B914-618C7628220B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"51465410-6B7C-40FD-A1AB-A14F650A6AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"851470CC-22AB-43E4-9CC6-5E22D49B3572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EBAB99E-6F0F-4CE9-A954-E8878826304C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6207-B2CF-487C-9CB8-906248B665C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D47B760D-5418-4FB0-88F0-3F78BAFF63E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0375C318-ECD2-4657-A0D7-4A0708266FBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26542F95-73F3-4906-838E-A66F5DC9DFA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60781FE4-38A3-4FEA-9D8B-CADE4B535974\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B169832-A746-49A6-8E92-06624AA9B13A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"981D701D-E381-484A-9614-CD0EF0331071\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4F126CA-A2F9-44F4-968B-DF71765869E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2153AECE-020A-4C01-B2A6-F9F5D98E7EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA76533A-5BED-4BDC-B348-EB3D3FDFB110\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1EFBD0F-9664-4EF3-9908-C72B1318F68F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5358E6E-8C01-408D-8692-B1A326DC630F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"104DBA04-538E-4CC5-9B6C-CFEDB40375AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4F0F121-700C-4D30-BAFC-960DCC56F08B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E5761F7-C287-4EC4-A899-C54FB4E80A35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B184BFC-8E1A-4971-B6D2-C594742AB8CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA51AC1B-0BF6-44F6-B034-CAD4F623DD76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BB34405-A2F1-461A-B51B-E103BB3680A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CFB56F4-91D1-4FBF-842A-04BB117CAF85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"035BF3B3-1AB9-43BC-BB37-68843818EDEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94347800-04D2-48C4-ACF0-078A5ACBB063\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E53783F4-60C7-4A92-8951-F8FD51170670\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"535EFD44-F81C-43B2-B595-81429468637F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7413107-D7B2-49AE-AC46-52E7BFCD6ED8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61636553-C25E-44DF-93D7-EB3E1056D1DC\"}]}]}],\"references\":[{\"url\":\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/\",\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-10611\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-16T13:24:33.931504Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-16T13:24:43.729Z\"}}], \"cna\": {\"title\": \"Potential Broken Access Control in Multiple WSO2 Products via System REST APIs\", \"source\": {\"advisory\": \"WSO2-2025-4585\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WSO2\", \"product\": \"WSO2 API Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.1.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.1.0\", \"lessThan\": \"2.1.0.42\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.2.0\", \"lessThan\": \"2.2.0.61\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.5.0\", \"lessThan\": \"2.5.0.87\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.6.0\", \"lessThan\": \"2.6.0.148\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.0.178\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.0.345\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.0.446\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.1\", \"lessThan\": \"3.2.1.66\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.0.366\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.0.228\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.0.169\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.0.81\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.4.0.45\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.28\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Control Plane\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.29\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking AM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.4.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.141\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.5.0.142\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.394\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking IAM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.414\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.3.0\", \"lessThan\": \"5.3.0.39\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.5.0\", \"lessThan\": \"5.5.0.54\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.6.0\", \"lessThan\": \"5.6.0.62\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.7.0\", \"lessThan\": \"5.7.0.128\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.8.0\", \"lessThan\": \"5.8.0.112\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.9.0\", \"lessThan\": \"5.9.0.171\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.375\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.11.0\", \"lessThan\": \"5.11.0.419\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.0.248\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.0.248\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.0.0.124\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.1.0\", \"lessThan\": \"7.1.0.31\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server as Key Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.3.0\", \"lessThan\": \"5.3.0.44\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.5.0\", \"lessThan\": \"5.5.0.55\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.6.0\", \"lessThan\": \"5.6.0.77\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.7.0\", \"lessThan\": \"5.7.0.127\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.9.0\", \"lessThan\": \"5.9.0.178\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.365\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking KM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.4.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.135\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.5.0.125\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Universal Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.27\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Traffic Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.27\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.16\", \"lessThan\": \"1.1.16.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.18\", \"lessThan\": \"1.1.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.20\", \"lessThan\": \"1.1.20.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.26\", \"lessThan\": \"1.1.26.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.3.6\", \"lessThan\": \"1.3.6.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.25\", \"lessThan\": \"1.4.25.27\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.52\", \"lessThan\": \"1.4.52.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.6.1\", \"lessThan\": \"1.6.1.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.7.1\", \"lessThan\": \"1.7.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.11\", \"lessThan\": \"1.8.11.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.41\", \"lessThan\": \"1.8.41.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.4\", \"lessThan\": \"1.9.4.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.18\", \"lessThan\": \"1.9.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8\", \"lessThan\": \"1.8.48\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"1.9.46\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"packageName\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\", \"defaultStatus\": \"unknown\"}, {\"vendor\": \"WSO2\", \"product\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.16\", \"lessThan\": \"1.1.16.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.18\", \"lessThan\": \"1.1.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.20\", \"lessThan\": \"1.1.20.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.26\", \"lessThan\": \"1.1.26.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.3.6\", \"lessThan\": \"1.3.6.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.25\", \"lessThan\": \"1.4.25.27\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.52\", \"lessThan\": \"1.4.52.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.6.1\", \"lessThan\": \"1.6.1.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.7.1\", \"lessThan\": \"1.7.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.11\", \"lessThan\": \"1.8.11.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.41\", \"lessThan\": \"1.8.41.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.4\", \"lessThan\": \"1.9.4.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.18\", \"lessThan\": \"1.9.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8\", \"lessThan\": \"1.8.48\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"1.9.46\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"packageName\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\", \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\\n\\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"shortName\": \"WSO2\", \"dateUpdated\": \"2025-10-16T12:09:31.802Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-10611\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-16T13:34:31.799Z\", \"dateReserved\": \"2025-09-17T08:56:27.794Z\", \"assignerOrgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"datePublished\": \"2025-10-16T12:09:31.802Z\", \"assignerShortName\": \"WSO2\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…