What is the CVSS score of CVE-2025-14561?

CVE-2025-14561 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of WSO2 API Manager are affected by CVE-2025-14561?

WSO2 API Manager deployments in multi-tenant environments face critical tenant isolation bypass allowing authenticated administrators to access and modify API metadata across separate tenant…. A patch is available.

How to fix or mitigate CVE-2025-14561?

Within 24 hours, conduct a complete inventory of WSO2 API Manager installations and identify all multi-tenant deployments; simultaneously query Publisher REST API audit logs for the past 30 days to detect cross-tenant API enumeration or modification operations. Within 7 days, implement principle-of-least-privilege on all publisher-level credentials, enforce multi-factor authentication on publisher accounts, and enable comprehensive audit logging for Publisher REST API operations with alerts configured for cross-tenant access attempts. Within 30 days, establish vendor support engagement to track patch release status and schedule an upgrade; meanwhile, evaluate architectural alternatives including single-tenant deployments or separate infrastructure instances per tenant, and implement network segmentation to logically isolate tenant environments.

WSO2 API Manager CVE-2025-14561

EUVD-2025-210647 CRITICAL

Improper Access Control (CWE-284)

2026-08-06 ed10eef1-636d-4fbe-9993-6890dfa878f8

GHSA-78r2-rh3v-h2fx

Authentication Bypass

9.0

CVSS 3.1 · Vendor: ed10eef1-636d-4fbe-9993-6890dfa878f8

Severity by source

Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.0 CRITICAL

Network-reachable Publisher API with low complexity but requiring existing publisher privileges (PR:H); scope changes as impact crosses into other tenants, with high confidentiality/integrity of API metadata and limited availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).

CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 06, 2026 - 23:03 EUVD

Analysis Generated

Aug 06, 2026 - 22:31 vuln.today

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.0

DescriptionCVE.org

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.

The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

AnalysisAI

Broken tenant isolation in WSO2 API Manager's Publisher REST APIs lets a privileged user in one tenant reach across tenant boundaries in multi-tenant deployments. Because the APIs do not correctly scope operations to the caller's tenant, an authenticated publisher-level account can enumerate, expose, or modify API metadata belonging to entirely separate tenant environments. No public exploit identified at time of analysis, but the vendor-assigned 9.0 (Critical) score and CVSS scope-change flag reflect the cross-tenant reach of the flaw.

Technical ContextAI

WSO2 API Manager is an enterprise API management platform whose Publisher component exposes REST APIs used to create, publish, and manage API definitions and their metadata. In multi-tenant mode, each tenant is expected to operate in an isolated namespace so that one organization's APIs are invisible and immutable to another. The root cause maps to CWE-284 (Improper Access Control): the Publisher REST endpoints authenticate and authorize the caller's privilege level but fail to bind the requested operation to the caller's own tenant domain, so a request that references or acts on another tenant's resources is honored rather than rejected. This is a horizontal (cross-tenant) authorization gap rather than a privilege-escalation-to-admin issue.

RemediationAI

Apply the fix published in WSO2 security advisory WSO2-2025-4918 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/); the exact patched version or WUM/update-tool level is not present in the provided data and must be taken from that advisory - no version number is invented here. As interim compensating controls for operators of shared multi-tenant deployments: tighten which accounts hold publisher-level privileges so that untrusted parties cannot invoke the affected Publisher REST APIs (reduces the pool of potential attackers at the cost of delegation flexibility); where feasible, isolate mutually-untrusted tenants into separate API Manager instances rather than shared multi-tenancy (strong isolation but higher operational overhead); and increase monitoring/audit logging on Publisher API calls that reference tenant domains other than the caller's for detection. These are mitigations, not fixes - patching is the only reliable resolution.