WSO2 Identity Server CVE-2025-14779

Exploitation requires: (1) a valid platform administrator account with explicit delete permissions on the WSO2 Secret Type Management REST API - the CVSS PR:H metric confirms this is not exploitable by unauthenticated or low-privileged users, and the description states this permission is not granted by default to non-administrators; (2) a multi-tenant WSO2 Identity Server deployment hosting multiple organizations on the same instance - single-tenant deployments are unaffected by the cross-organizational aspect, though their own secrets remain at risk from inadvertent deletion; and (3) at least one secret type with associated secrets distributed across multiple organizations. What limits exploitation: administrator credentials (PR:H) are required; default RBAC configuration does not grant this permission broadly; the attacker must have network access to the REST API endpoint and knowledge of the target secret type identifier.

The CVSS 3.8 base score reflects a genuinely low-severity finding. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) confirms that exploitation requires high privileges (administrator with explicit delete permissions on the Secret Type Management REST API), is network-accessible, requires no user interaction, and produces limited integrity and availability impact with no confidentiality breach. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exists - exploitation risk is currently theoretical. Real-world risk is highest in large multi-tenant deployments (SaaS or shared enterprise IAM infrastructure) where a single platform administrator could trigger cross-organizational impact affecting many tenants simultaneously. Single-tenant deployments face impact limited to that one organization. The absence of a confidentiality vector (C:N) means no data is disclosed - the risk is purely operational disruption from deleted secrets causing downstream service failures.

A platform administrator with delete permissions on the Secret Type Management REST API sends a DELETE request to remove a secret type (e.g., one associated with OAuth connectors). The cascade delete logic, lacking organizational boundary enforcement, removes all secrets of that type across every tenant organization in the deployment. Connectors, adaptive authentication scripts, and integrations relying on those secrets immediately begin failing, causing authentication breakdowns and service interruptions across all affected tenant organizations.