What is the CVSS score of CVE-2025-14779?

CVE-2025-14779 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-14779?

Yes, a patch is available for CVE-2025-14779. Update the affected software to the latest version immediately.

WSO2 Identity Server CVE-2025-14779

EUVD-2025-210628 LOW

Improper Preservation of Permissions (CWE-281)

2026-08-06 WSO2

GHSA-w9fx-wqmj-rf65

Information Disclosure Wso2 Identity Server Wso2 Carbon Identity Api Server Secret Management Common Wso2 Carbon Identity Api Server Secret Management V1 Wso2

3.8

CVSS 3.1 · Vendor: WSO2

Severity by source

Vendor (WSO2) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.8 LOW

Network-accessible REST API requires admin delete permissions (PR:H); no confidentiality impact as secrets are deleted, not disclosed.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Primary rating from Vendor (WSO2).

CVSS VectorVendor: WSO2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Aug 06, 2026 - 09:01 EUVD

Analysis Generated

Aug 06, 2026 - 08:34 vuln.today

DescriptionCVE.org

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations.

Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.

AnalysisAI

Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WSO2 Identity Server is an enterprise IAM/CIAM platform used for authentication, authorization, and identity federation. The affected components - identified in CPE as wso2:wso2_carbon_identity_api_server_secret_management_common and wso2:wso2_carbon_identity_api_server_secret_management_v1 - expose REST APIs for managing secret types, which are named containers used by connectors, adaptive authentication scripts, and service integrations. CWE-281 (Improper Preservation of Permissions) describes flaws where an operation fails to maintain proper authorization scope across a security boundary. Here, the cascade delete path triggered by a DELETE call on a secret type does not scope its deletion query to the requesting administrator's organization, causing it to traverse all tenant organizations in the shared deployment and remove all secrets associated with that type globally.

RemediationAI

Consult the WSO2 security advisory WSO2-2025-4597 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4597/ for the official patched release version, which is not independently confirmed from available input data. As an immediate compensating control, audit and restrict which administrator accounts hold delete permissions on the Secret Type Management REST API, reducing the blast radius by minimizing the number of accounts that could trigger the cascade. In multi-tenant environments, consider implementing a secondary approval workflow or monitoring alert for any secret type deletion operations until the patch is applied - note this may add operational friction for legitimate administrative tasks. Avoid deleting secret types in production multi-tenant deployments until patched. If possible, take a backup of all secret data before any secret type management operations.