by Kastro
Paper/Archive/CVE-2026-4052

CVE-2026-4052

WSO2 WSO2 API Manager — Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

Affected

ProductAffectedFixed inSource
WSO2 API Manager4.1.0–CNA
WSO2 API Manager4.2.0–CNA
WSO2 API Manager4.3.0–CNA
WSO2 API Manager4.4.0–CNA
WSO2 API Manager4.5.0–CNA
WSO2 API Manager4.6.0–CNA
WSO2 API Control Plane4.5.0–CNA
WSO2 API Control Plane4.6.0–CNA
WSO2 Identity Server Key Manager Connector (apim-km-wso2is)< 1.8.81.8.8CNA

Scores by source

WSO2 (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212