WSO2 API Manager CVE-2025-11969

Exploitation targets the System/management REST APIs of affected WSO2 products (WSO2 API Manager, Identity Server as Key Manager, Open Banking AM/IAM, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon API Manager REST API Utility/Common Functions components), which fail to enforce role-based authorization. The description indicates the actor operates with a lower-privilege role, implying a valid authenticated account is the realistic precondition - this directly conflicts with the vendor vector's PR:N and should be confirmed with WSO2. A key LIMITING factor stated explicitly by the vendor: APIs exposed through the WSO2 API Manager's API Gateway are NOT affected, so exploitation is confined to the management/System REST API surface, not gateway-proxied traffic. No user interaction is required and attack complexity is low once the management endpoint is reachable.

This is a genuine high priority, not an inflated CVSS number. The vendor (WSO2) CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L scores 9.4 with network vector, low complexity, no privileges and no user interaction, and the vuln.today Decision label is act_now - consistent with a serious, easily-reachable authorization flaw (CWE-285) in management REST APIs. However, there is a material conflict: the description states the flaw allows 'users with lower privilege roles to execute administrative actions,' which implies the attacker must already hold some authenticated low-privilege role, whereas the vendor vector encodes PR:N (no privileges). This should be verified with WSO2 - if a valid low-privilege account is required, real-world exploitability is somewhat narrowed to users who can already authenticate (insiders, compromised accounts, or self-registration if enabled). EPSS exploitation probability is not provided, the CVE is NOT listed in CISA KEV, and no POC or exploit reference is present in the input, so there is currently no evidence of active or public exploitation. Net assessment: a credible privilege-escalation/broken-access-control issue in enterprise API-management infrastructure that warrants prompt patching per the act_now label, with the authentication precondition and absence of exploitation signals being the main factors tempering raw-severity urgency.

An actor with a low-privilege WSO2 account (or, if PR:N holds, an unauthenticated remote attacker) sends requests to the System/management REST APIs, which fail to enforce role-based access control, and invokes administrative functions that should be restricted to admins. Because the vector is network-based with low attack complexity, this requires only reaching the management API endpoint and issuing the privileged call. No public exploit identified at time of analysis; APIs exposed through the WSO2 API Manager API Gateway are explicitly not affected.