9.8

CVE-2026-1728

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Api Control Plane Version >= 4.5.0 < 4.5.0.49
Wso2 ≫ Api Control Plane Version >= 4.6.0 < 4.6.0.13
Wso2 ≫ Api Manager Version >= 4.0.0 < 4.0.0.384
Wso2 ≫ Api Manager Version >= 4.1.0 < 4.1.0.248
Wso2 ≫ Api Manager Version >= 4.2.0 < 4.2.0.188
Wso2 ≫ Api Manager Version >= 4.3.0 < 4.3.0.99
Wso2 ≫ Api Manager Version >= 4.4.0 < 4.4.0.63
Wso2 ≫ Api Manager Version >= 4.5.0 < 4.5.0.48
Wso2 ≫ Api Manager Version >= 4.6.0 < 4.6.0.12
Wso2 ≫ Traffic Manager Version >= 4.5.0 < 4.5.0.47
Wso2 ≫ Traffic Manager Version >= 4.6.0 < 4.6.0.12
Wso2 ≫ Universal Gateway Version >= 4.5.0 < 4.5.0.48
Wso2 ≫ Universal Gateway Version >= 4.6.0 < 4.6.0.12
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.219
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ed10eef1-636d-4fbe-9993-6890dfa878f8 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/
Vendor Advisory