Read the docs
TI-2026-01411 Aliases CVE-2026-1728GHSA-88j3-cjwq-qqvv

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Priority MEDIUM 49CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00483 41st percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 4.0.0.384, 4.1.0.248, 4.2.0.188 +4WSO2 API Control Plane (WSO2): 4.5.0.49, 4.6.0.13+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager4.0.0 to before 4.0.0.384; 4.1.0 to before 4.1.0.248; 4.2.0 to before 4.2.0.188; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.124.0.0.384, 4.1.0.248, 4.2.0.188, 4.3.0.99, 4.4.0.63, 4.5.0.48, 4.6.0.12Patch availableCNA
WSO2WSO2 API Control Plane4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.134.5.0.49, 4.6.0.13Patch availableCNA
WSO2WSO2 Universal Gateway4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.124.5.0.48, 4.6.0.12Patch availableCNA
WSO2WSO2 Traffic Manager4.5.0 to before 4.5.0.47; 4.6.0 to before 4.6.0.124.5.0.47, 4.6.0.12Patch availableCNA
WSO2WSO2 Carbon API Manager Rest API Common Functions9.0.174 to before 9.0.174.550; 9.28.116 to before 9.28.116.404; 9.29.120 to before 9.29.120.221; 9.30.67 to before 9.30.67.146; 9.31.86 to before 9.31.86.130; 9.32.147 to before 9.32.147.269.0.174.550, 9.28.116.404, 9.29.120.221, 9.30.67.146, 9.31.86.130, 9.32.147.26, 9.33.27Patch availableCNA
WSO2WSO2 Carbon API Manager Rest API Utility9.20.74 to before 9.20.74.3929.20.74.392, 9.33.27Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 4.0.0 to before 4.0.0.384; 4.1.0 to before 4.1.0.248; 4.2.0 to before 4.2.0.188; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12 Fixed in 4.0.0.384, 4.1.0.248, 4.2.0.188, 4.3.0.99, 4.4.0.63, 4.5.0.48, 4.6.0.12 Patch available CNA
  • WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Fixed in 4.5.0.49, 4.6.0.13 Patch available CNA
  • WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12 Fixed in 4.5.0.48, 4.6.0.12 Patch available CNA
  • WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.47; 4.6.0 to before 4.6.0.12 Fixed in 4.5.0.47, 4.6.0.12 Patch available CNA
  • WSO2 Carbon API Manager Rest API Common Functions VendorWSO2 Affected 9.0.174 to before 9.0.174.550; 9.28.116 to before 9.28.116.404; 9.29.120 to before 9.29.120.221; 9.30.67 to before 9.30.67.146; 9.31.86 to before 9.31.86.130; 9.32.147 to before 9.32.147.26 Fixed in 9.0.174.550, 9.28.116.404, 9.29.120.221, 9.30.67.146, 9.31.86.130, 9.32.147.26, 9.33.27 Patch available CNA
  • WSO2 Carbon API Manager Rest API Utility VendorWSO2 Affected 9.20.74 to before 9.20.74.392 Fixed in 9.20.74.392, 9.33.27 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13VulnerableWSO2
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*4.0.0 to before 4.0.0.384; 4.1.0 to before 4.1.0.248; 4.2.0 to before 4.2.0.188; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12VulnerableWSO2
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.47; 4.6.0 to before 4.6.0.12VulnerableWSO2
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12VulnerableWSO2
  • cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.49; 4.6.0 to before 4.6.0.13 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.0.384; 4.1.0 to before 4.1.0.248; 4.2.0 to before 4.2.0.188; 4.3.0 to before 4.3.0.99; 4.4.0 to before 4.4.0.63; 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.47; 4.6.0 to before 4.6.0.12 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.48; 4.6.0 to before 4.6.0.12 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 4.0.0.384, 4.1.0.248, 4.2.0.188, 4.3.0.99, 4.4.0.63, 4.5.0.48, 4.6.0.12
  • Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.49, 4.6.0.13
  • Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.48, 4.6.0.12
  • Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.47, 4.6.0.12
  • Fix · CNA WSO2 Carbon API Manager Rest API Common Functions (WSO2) Fixed in 9.0.174.550, 9.28.116.404, 9.29.120.221, 9.30.67.146, 9.31.86.130, 9.32.147.26, 9.33.27
  • Fix · CNA WSO2 Carbon API Manager Rest API Utility (WSO2) Fixed in 9.20.74.392, 9.33.27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1728
  2. 2026-10-03 Alias added: GHSA-88j3-cjwq-qqvv

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
  • TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
  • TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
  • TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
  • TI-2026-03696 Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2… CVSS 3.1HIGH 8.6
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences