Wso2 Carbon Identity Api Server Secret Management V1
Monthly
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.