EUVD-2026-53821
GHSA-88j3-cjwq-qqvv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description requires an existing low-privileged account and a valid token, so PR:L not PR:N; remote, low-complexity token replay grants full admin control giving C:H/I:H/A:H.
Primary rating from Vendor (WSO2).
CVSS VectorVendor: WSO2
Lifecycle Timeline
3DescriptionCVE.org
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
AnalysisAI
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Technical ContextAI
The affected products are part of WSO2's Carbon-based API management platform (WSO2 API Manager, API Control Plane, Universal Gateway, Traffic Manager) and the shared 'carbon_api_manager_rest_api_common_functions' and 'carbon_api_manager_rest_api_utility' components identified in the CPE list. These platforms expose administrative functionality through Admin REST APIs that are intended to be gated behind administrative roles/scopes. The vulnerability maps to CWE-269 (Improper Privilege Management): tokens minted for low-privileged users are not adequately constrained (insufficient scope or role enforcement), so the authorization layer that should reject non-admin tokens at the Admin REST API boundary fails to do so. Because the flawed component is shared REST-API utility code, the weakness propagates across multiple products that reuse it.
RemediationAI
Apply the fix described in WSO2 security advisory WSO2-2026-5077 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/); patch available per vendor advisory, though an exact fixed version is not present in the provided data and should be taken directly from that advisory (typically delivered as a WSO2 Update / WUM patch for the affected products). As compensating controls until patched, restrict network reachability of the Admin REST API endpoints to trusted management networks or an internal admin VLAN (trade-off: breaks legitimate remote admin automation), tighten or disable self-service user registration so attackers cannot easily obtain the low-privileged accounts this exploit depends on, and audit/rotate tokens and review Admin REST API access logs for calls originating from non-admin principals. Where feasible, enforce stricter scope validation at a fronting gateway/WAF for the admin API paths as a stopgap.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing opera
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today