EUVD-2025-210631
GHSA-8rr2-f52p-r9q3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Carbon console endpoint
-
DeliveryHost malicious page with crafted cross-origin GET request
-
ExploitPhish authenticated WSO2 admin to visit page
-
ExecutionBrowser transmits session cookie via SameSite=Lax bypass
-
PersistCarbon Ajax processor executes unauthorized state-changing operation
-
ImpactIdentity, API, or account configuration modified without admin awareness
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three conditions must simultaneously hold for successful exploitation: (1) the Carbon console must be network-reachable from the attacker's delivery origin, meaning it is either internet-exposed or the attack originates from the same internal network segment - WSO2 explicitly states this deployment posture is not recommended; (2) an administrator must hold an active authenticated session in their browser and be socially engineered into visiting an attacker-controlled URL or redirected from a compromised third-party site; (3) the Carbon console must be processing state-changing operations over HTTP GET through the Ajax processor, which is the confirmed design flaw described in this CVE. The attacker requires no credentials of their own (CVSS PR:N); however, a valid administrative session cookie must be present in the victim's browser at the time of exploitation. Exploitation is not feasible against Carbon consoles correctly isolated behind internal network boundaries, as the cross-origin request cannot reach the server. The limiting factors - required admin social engineering, mandatory user interaction (CVSS UI:R), and network accessibility prerequisite - materially reduce real-world exploitability below what the CVSS base score alone implies. |
| Impact | The CVSS 3.1 score of 5.4 Medium is derived from a network-delivered attack (AV:N) with low complexity (AC:L), no attacker privileges required (PR:N), mandatory user interaction (UI:R), unchanged scope (S:U), and limited integrity and availability impact with no confidentiality exposure (C:N/I:L/A:L). No EPSS data was provided in available input, and CISA KEV status is not confirmed, nor is public exploit code reported - exploitation must be classified as 'no public exploit identified at time of analysis.' Real-world exploitability is substantially constrained beyond the raw CVSS score: successful attacks require an authenticated administrator to be socially engineered into visiting an attacker-controlled page while holding an active session, and critically, WSO2 explicitly states in their security guidelines that the Carbon console should never be internet-exposed. Deployments following WSO2 hardening guidance face negligible external CSRF risk. The primary real-world risk vector is insider-adjacent attacks or deployments where management consoles are incorrectly network-accessible. The wide product footprint (10+ products) increases aggregate exposure across enterprise environments that have not applied WSO2's recommended network isolation. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page containing an image tag, invisible iframe, or auto-redirect pointing to a Carbon console Ajax GET endpoint that triggers a state-changing action - such as modifying a user role, altering an API policy, or changing account settings. A phishing email or watering-hole compromise lures an authenticated WSO2 administrator into visiting the page while their console session is active; the browser automatically follows the GET request and attaches the session cookie under SameSite=Lax rules, causing the unauthorized operation to execute server-side without any visible indication to the administrator. No public exploit code has been reported, but the CSRF technique exploiting SameSite=Lax on GET-based operations is well-documented in public security research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
RemediationAI
Apply the fix documented in WSO2 security advisory WSO2-2025-4800 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/); no specific patched version number was available in the input data, so consult the advisory directly for exact upgrade targets. The single most effective compensating control - and WSO2's own stated recommendation - is to ensure the Carbon console and all WSO2 management interfaces are network-isolated and not reachable from the public internet; if followed, this eliminates the external CSRF attack surface entirely. Where immediate network isolation is not feasible, consider upgrading the Carbon console session cookie to SameSite=Strict (which blocks all cross-origin cookie transmission, including top-level GET navigation), though this change may break legitimate cross-origin SSO or redirect flows and should be tested in staging first. Alternatively, deploying a WAF rule to validate that the HTTP Referer or Origin header on Carbon Ajax endpoints matches the expected management domain can block cross-origin CSRF requests, but this control is bypassable if Referer stripping is in play and requires precise rule authoring. Network isolation remains the recommended primary control; cookie and WAF mitigations are secondary and should not substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 47 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Carbon console is WSO2's shared legacy administrative web interface underlying all major WSO2 middleware products, as confirmed by CPE data spanning Identity Server, API Manager, Open Banking IAM/AM, Enterprise Integrator, API Control Plane, Universal Gateway, Traffic Manager, and numerous Carbon UI subcomponents. The root cause is CWE-352 (Cross-Site Request Forgery), compounded by an architectural choice to serve state-changing Ajax operations over HTTP GET rather than POST. This design makes conventional CSRF synchronizer-token mitigations inapplicable, because those patterns rely on embedding a secret in the request body or as a non-GET parameter. The SameSite=Lax cookie attribute was deployed as a substitute mitigation, but the Lax policy explicitly permits cookies to be transmitted on cross-origin top-level navigation GET requests - for example, when a user follows a hyperlink or is redirected - which is precisely the vector this attack exploits. A complete CSRF defense would require SameSite=Strict, custom Origin/Referer header validation, or anti-CSRF tokens embedded in all state-changing requests.
Know when Wso2 Api Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no credentials (PR:N) but victim must be actively tricked (UI:R); GET-based CSRF yields limited state modification (I:L) and potential session/account disruption (A:L) with no confidentiality exposure (C:N).
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
1DescriptionCVE.org
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.
An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Ga
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to ar
Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attac
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound t
Exploit-DB