Critical severity · published Aug 6, 2026
CVE-2025-14561
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
9.0
CVSS
0.4%
EPSS
No
On KEV
Description
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WSO2 API Control Plane · WSO2
4.5.0 before 4.5.0.42; 4.6.0 before 4.6.0.7 · source: vendor
WA
WSO2 API Manager · WSO2
4.1.0 before 4.1.0.242; 4.2.0 before 4.2.0.182; 4.3.0 before 4.3.0.93; 4.4.0 before 4.4.0.57; 4.5.0 before 4.5.0.41; 4.6.0 before 4.6.0.6 · source: vendor
WC
WSO2 Carbon API Management Implementation · WSO2
9.20.74 before 9.20.74.388; 9.28.116 before 9.28.116.395; 9.29.120 before 9.29.120.213; 9.30.67 before 9.30.67.135; 9.31.86 before 9.31.86.108; 9.32.147 before 9.32.147.5 · source: vendor
WC
WSO2 Carbon API Manager Rest API Utility · WSO2
9.20.74 before 9.20.74.388; 9.28.116 before 9.28.116.395; 9.29.120 before 9.29.120.213; 9.30.67 before 9.30.67.135; 9.31.86 before 9.31.86.108; 9.32.147 before 9.32.147.5 · source: vendor
WT
WSO2 Traffic Manager · WSO2
4.5.0 before 4.5.0.40; 4.6.0 before 4.6.0.6 · source: vendor
WU
WSO2 Universal Gateway · WSO2
4.5.0 before 4.5.0.40; 4.6.0 before 4.6.0.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14561
security.docs.wso2.com
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/
More from WSO2 API Control Plane
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.4
CVE-2025-15039
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
9.1
CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
8.8
CVE-2025-8325
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations