TI-2025-44008 Aliases CVE-2025-11229 GHSA-j5hr-4hjj-xvw9

Privilege escalation via client credentials grant in WSO2 Identity Server

LOW 32CWE-269Published 2026-11-04 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

WSO2 Identity Server from 7.0.0 before 7.0.0.125 and from 7.1.0 before 7.1.0.32 fails to enforce scope authorization when the authorize_all_scopes configuration is enabled. Applications using the client credentials grant can obtain all API scopes, including sensitive internal and console scopes, without explicit authorization, a case of improper privilege management (CWE-269). An attacker who controls a registered client with the client credentials grant can perform unauthorized administrative actions and access confidential data, and the flaw matters only where authorize_all_scopes is set away from its default disabled state.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls. Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

Why it matters now

EPSS 0.00355 29th percentileScored 2026-11-07

Fix Fixed WSO2 Identity Server (WSO2): 7.0.0.125, 7.1.0.32WSO2 Identity Application Management Component (WSO2): 7.0.78.137, 7.8.23.49

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WSO2	WSO2 Identity Server	7.0.0 to before 7.0.0.125; 7.1.0 to before 7.1.0.32	7.0.0.125, 7.1.0.32	Patch available	CNA
WSO2	WSO2 Identity Application Management Component	7.0.78 to before 7.0.78.137; 7.8.23 to before 7.8.23.49	7.0.78.137, 7.8.23.49	Patch available	CNA

WSO2 Identity Server VendorWSO2 Affected 7.0.0 to before 7.0.0.125; 7.1.0 to before 7.1.0.32 Fixed in 7.0.0.125, 7.1.0.32 Patch available CNA
WSO2 Identity Application Management Component VendorWSO2 Affected 7.0.78 to before 7.0.78.137; 7.8.23 to before 7.8.23.49 Fixed in 7.0.78.137, 7.8.23.49 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:wso2:identity_server::::::::	—	—	WSO2

cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Upgrade WSO2 Identity Server to 7.0.0.125 or 7.1.0.32. Upgrade WSO2 Identity Application Management Component to 7.0.78.137 or 7.8.23.49.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA WSO2 Identity Server (WSO2) Fixed in 7.0.0.125, 7.1.0.32
Fix · CNA WSO2 Identity Application Management Component (WSO2) Fixed in 7.0.78.137, 7.8.23.49

Timeline

2026-11-04 Threatist record created from CVE-2025-11229
2026-11-04 Alias added: GHSA-j5hr-4hjj-xvw9
2026-11-05 Priority changed: MEDIUM → LOW

References

Advisory 1

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/

TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1

See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences