CVE-2025-14561

9.0 Critique

Publiée le 07/08/2026 à 00:16 · Modifiée le 29/09/2026 à 13:10 · Analyse NVD reportée · Source : ed10eef1-636d-4fbe-9993-6890dfa878f8

Description

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Traduire en français

Produits concernés

WSO2 API Manager
WSO2 API Control Plane
WSO2 Traffic Manager
WSO2 Universal Gateway
WSO2 Carbon API Management Implementation
WSO2 Carbon API Manager Rest API Utility

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.0 Critique	ed10eef1-636d-4fbe-9993-6890dfa878f8	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-284

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories