WSO2 API Manager EUVD-2025-209759

Attacker must hold a valid user account on the target deployment, but the abused 'Internal/Everyone' role is assigned to every authenticated user by default, so in practice any account suffices (PR:L, AC:L, no user interaction). The affected surface is the Gateway REST API, plus Internal Service APIs specifically in WSO2 APIM 3.x versions. Limiting factors: exploitation is authenticated-only (no anonymous/unauthenticated path), so exposure depends on who can obtain accounts - internet-facing self-service or broad-tenant deployments are most at risk, while deployments with tightly controlled account provisioning are far less exposed. Affected products span WSO2 API Manager (3.2.x-4.5.x), Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Management Implementation / REST API Utility components below the fixed patch levels.

Conflicting severity signals: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) rates this 8.8 HIGH with full C:H/I:H/A:H impact, yet nearly every other signal points to low real-world urgency. EPSS is only 0.03% (10th percentile), there is no CISA KEV listing (SSVC Exploitation: none), the issue is not Automatable (no), and CISA's SSVC rates Technical Impact as only 'partial' - directly contradicting the CVSS all-High impact metrics, which should be verified against vendor scoping. Exploitation requires a valid, authenticated account (PR:L), so this is not a remote-unauthenticated internet threat; however the aggravating factor is that the abusable 'Internal/Everyone' role is granted to EVERY authenticated user by default, so any legitimate low-privilege user becomes an attacker. Net: a genuine broken-access-control defect worth patching on a normal cycle, but currently a high-CVSS / low-real-risk item rather than an emergency - no public exploit identified at time of analysis and no evidence of active exploitation.

A low-privilege user who holds only the default 'Internal/Everyone' role - automatically assigned to all accounts - authenticates to a WSO2 API Manager deployment and directly invokes Gateway REST API (and in 3.x, Internal Service API) endpoints that should be restricted to administrators. Because role-based checks are not enforced, the user performs sensitive gateway operations and can disclose internal service information regardless of their assigned privileges. No public exploit code is identified at time of analysis, and the low complexity (AC:L) means a valid account is the only real prerequisite.