CVE-2025-10611

critical · 9.8

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

9.8

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2025-10-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-863

Affected products

Vendor	Product	Affected versions
wso2	api_control_plane	4.5.0
wso2	api_manager	2.1.0
wso2	api_manager	2.2.0
wso2	api_manager	2.5.0
wso2	api_manager	2.6.0
wso2	api_manager	3.0.0
wso2	api_manager	3.1.0
wso2	api_manager	3.2.0
wso2	api_manager	3.2.1
wso2	api_manager	4.0.0
wso2	api_manager	4.1.0
wso2	api_manager	4.2.0
wso2	api_manager	4.3.0
wso2	api_manager	4.4.0
wso2	api_manager	4.5.0
wso2	identity_server	5.3.0
wso2	identity_server	5.5.0
wso2	identity_server	5.6.0
wso2	identity_server	5.7.0
wso2	identity_server	5.8.0
wso2	identity_server	5.9.0
wso2	identity_server	5.10.0
wso2	identity_server	5.11.0
wso2	identity_server	6.0.0
wso2	identity_server	6.1.0
wso2	identity_server	7.0.0
wso2	identity_server	7.1.0
wso2	identity_server_as_key_manager	5.3.0
wso2	identity_server_as_key_manager	5.5.0
wso2	identity_server_as_key_manager	5.6.0
wso2	identity_server_as_key_manager	5.7.0
wso2	identity_server_as_key_manager	5.9.0
wso2	identity_server_as_key_manager	5.10.0
wso2	open_banking_am	1.4.0
wso2	open_banking_am	1.5.0
wso2	open_banking_am	2.0.0
wso2	open_banking_iam	2.0.0
wso2	open_banking_km	1.4.0
wso2	open_banking_km	1.5.0
wso2	traffic_manager	4.5.0

Check a specific version with /api/v1/cve/match.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-10611