by Kastro CVE-2026-1728
WSO2 WSO2 API Manager — Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Description · from the CVE record
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Affected
ProductAffectedFixed inSource
WSO2 API Manager4.0.0 – < 4.0.0.3844.0.0.384CNA
WSO2 API Manager4.1.0 – < 4.1.0.2484.1.0.248CNA
WSO2 API Manager4.2.0 – < 4.2.0.1884.2.0.188CNA
WSO2 API Manager4.3.0 – < 4.3.0.994.3.0.99CNA
WSO2 API Manager4.4.0 – < 4.4.0.634.4.0.63CNA
WSO2 API Manager4.5.0 – < 4.5.0.484.5.0.48CNA
WSO2 API Manager4.6.0 – < 4.6.0.124.6.0.12CNA
WSO2 API Control Plane4.5.0 – < 4.5.0.494.5.0.49CNA
WSO2 API Control Plane4.6.0 – < 4.6.0.134.6.0.13CNA
WSO2 Universal Gateway4.5.0 – < 4.5.0.484.5.0.48CNA
WSO2 Universal Gateway4.6.0 – < 4.6.0.124.6.0.12CNA
WSO2 Traffic Manager4.5.0 – < 4.5.0.474.5.0.47CNA
Scores by source
WSO2 (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total