WSO2 API Manager CVE-2026-4052

Exploitation is gated to a specific non-default architecture: WSO2 Identity Server deployed as a Resident Key Manager AND sharing a database with WSO2 API Manager. Under that configuration, an attacker must obtain a valid user account - the description specifies a self-registered user - and acquire a token from the Identity Server token endpoint, which is then improperly honored for the API Manager System REST APIs. Limiting factors: deployments not using the Resident Key Manager mode or not sharing a database are not affected; if self-registration is disabled the attacker cannot trivially obtain the starting account; the official CVSS marks PR:N but the described flow requires a self-registered identity, so authentication requirements beyond self-registration should be verified against the vendor advisory.

The input CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical with network vector, low complexity, no privileges and no user interaction. However, this raw score must be weighed against a strong limiting signal in the description: the flaw only affects deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing - a specific, non-default architecture - so the real-world attack surface is narrower than a flat 9.8 implies. There is a signal conflict worth noting: the CVSS vector claims PR:N (unauthenticated), yet the description says a 'self-registered user' obtains the token, implying the attacker must first create an account via self-registration; where self-registration is open this is effectively unauthenticated, but where it is disabled the precondition is not met. The vendor-assigned priority is act_now, which keeps this urgent for affected operators. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the supplied data, so there is no evidence of active exploitation or published exploit code - the urgency here derives from the vendor decision label and critical impact, not from observed exploitation. Net assessment: a genuine high priority for the subset of environments running the affected Resident Key Manager + shared-database configuration, and a lower practical concern for deployments not using that mode.

In an environment where WSO2 Identity Server runs as a Resident Key Manager sharing a database with WSO2 API Manager, an attacker creates a self-registered user account and requests an OAuth token from the Identity Server token endpoint. Because authorization is not properly enforced across the shared deployment, that token is accepted for the System (admin-level) REST APIs of WSO2 API Manager, granting the low-privilege user administrative API access. No public proof-of-concept or exploit code is referenced in the available data.