WSO2 API Manager CVE-2026-2613

Exploitation requires authenticated access to the WSO2 Admin REST API with administrator privileges (CVSS PR:H); the attacker supplies input that is insufficiently sanitized before being incorporated into the structure of SQL statements, yielding blind SQL injection. The administrator-privilege requirement is the primary limiting factor - this is not reachable by unauthenticated or low-privileged users - so realistic risk centers on compromised/abused admin credentials or malicious insiders rather than broad remote attack. The specific vulnerable feature or endpoint beyond 'the Admin REST API' is not further detailed in the available sources, and no non-default configuration is cited as a prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H, base 8.7 High) shows a network-reachable, low-complexity flaw that nonetheless requires high privileges - the description and vector agree that the attacker must already hold administrator rights on the WSO2 Admin REST API, so PR:H is well-grounded rather than a case of CVSS and description conflicting. This is the decisive mitigating factor: the vulnerability is a privilege-escalation-of-impact / trust-boundary issue available only to authenticated administrators, not a pre-auth remote compromise. The scope change (S:C) and A:H reflect that blind SQL injection reaches the backend database service and can degrade its availability, while C:H reflects inference of database contents; I:N indicates the vendor does not credit data modification. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were supplied - only the WSO2 vendor advisory - so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_week', consistent with a serious but admin-gated issue rather than an emergency. Net: a genuine High-severity bug worth patching on the vendor's indicated timeline, but the administrator-privilege precondition substantially limits real-world attacker reach compared with the raw 8.7 score.

An authenticated administrator (or an attacker who has already compromised admin credentials or a session) sends crafted input to the WSO2 Admin REST API, which is concatenated into SQL statement structure. By observing differential responses, they perform blind SQL injection to infer database contents and can issue queries that degrade the database service's availability. No public exploit code or PoC reference was provided; only a vendor advisory exists.