CVE-2026-1728

9.8 Critique

Publiée le 06/08/2026 à 10:16 · Modifiée le 10/08/2026 à 14:32 · Analysée par le NVD · Source : ed10eef1-636d-4fbe-9993-6890dfa878f8

Description

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Traduire en français

Produits concernés

WSO2 API Manager
WSO2 API Control Plane
WSO2 Universal Gateway
WSO2 Traffic Manager
WSO2 Carbon API Manager Rest API Common Functions
WSO2 Carbon API Manager Rest API Utility

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	ed10eef1-636d-4fbe-9993-6890dfa878f8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-269

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/ Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories