WSO2 System REST API Broken Access Control (CVE-2025-11969)

WSO2 says, "Due to improper access control in System REST APIs, a user with low privileges can perform unauthorized actions, including executing administrative actions." The advisory adds that APIs created and exposed through WSO2 API Manager's API Gateway are not affected by this flaw.

WSO2 rates CVE-2025-11969 9.4 Critical in CVSS v3.1, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. NVD's record carries only this score, credited to WSO2 as the CNA. No CVSS v4.0 score appears in the record or on NVD.

What the Record Does Not Say

WSO2 names no specific lower-privilege role or administrative action in its public advisory. The record does not state how an attacker reaches the System REST APIs beyond network access, or whether a proof-of-concept exploit has been published.

A Nine-Month Gap Between the Fix and the CVE Record

WSO2 merged the fix in carbon-apimgt pull request 13521 on 27 October 2025, under the generic title "Improve code." It published advisory WSO2-2025-4733 on 26 January 2026, about three months later. NVD published the CVE record, carrying WSO2's own CVSS score, on 2 November 2026, roughly nine months after the advisory.

What WSO2 and CISA KEV Say About Exploitation

These are the public signals we checked on 2 November 2026. Each one is listed below with what it currently shows.

A similar access control failure hit Atlassian Confluence in 2023. Confluence's own broken access control flaw, CVE-2023-22515, let an attacker with no login create an administrator account. Microsoft later reported nation-state exploitation (Storm-0062), and CISA added it to its KEV catalog. WSO2's flaw needs an existing lower-privilege account, a narrower starting point, but both show a server failing to check a role before an administrative action.

WSO2's advisory WSO2-2025-4733 lists one fixed update level per product, for seven products together. WSO2 API Manager spans the widest range, from 3.1.0 through 4.5.0; the rest sit on a single version each.

NVD's record also lists two underlying library packages behind these products, org.wso2.carbon.apimgt.rest.api.util and org.wso2.carbon.apimgt.rest.api.common. The util package carries affected build lines from 6.6.163 through 9.31.86; the common-functions package from 9.0.174 through 9.31.86. Both reach the fix at build 9.32.147 and later.

The second gap, between these library build numbers and the product-level update levels above, is why checking the exact build matters as much as the product name. Our vulnerability management guide covers how to plan an update across several products on different release trains. Two of the seven affected products are WSO2's Open Banking line, which puts this patch on the list for financial services teams running WSO2-based API infrastructure.

Missing-authorization gaps on APIs are not unique to WSO2. IBM API Connect tenant-takeover flaw CVE-2026-17362 lets a remote attacker create, modify or delete tenants with no privileges required, CVSS 3.1 9.8.