CVE-2025-14561
Critical
Description
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
SeverityCritical
CVSS9.0
Exploit probability—
ProductWSO2 API Manager
PublishedAug 6, 2026
First seenAug 6, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- WSO2 WSO2 API Manager4.1.0.242, 4.2.0.182, 4.3.0.93, 4.4.0.57, 4.5.0.41, 4.6.0.6 or later
- WSO2 WSO2 API Control Plane4.5.0.42, 4.6.0.7 or later
- WSO2 WSO2 Traffic Manager4.5.0.40, 4.6.0.6 or later
- WSO2 WSO2 Universal Gateway4.5.0.40, 4.6.0.6 or later
- WSO2 WSO2 Carbon API Management Implementation9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5 or later
- WSO2 WSO2 Carbon API Manager Rest API Utility9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.242, 4.2.0 ≤ v < 4.2.0.182, 4.3.0 ≤ v < 4.3.0.93, 4.4.0 ≤ v < 4.4.0.57, 4.5.0 ≤ v < 4.5.0.41, 4.6.0 ≤ v < 4.6.0.6 | 4.1.0.242, 4.2.0.182, 4.3.0.93, 4.4.0.57, 4.5.0.41, 4.6.0.6 |
| WSO2 WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.42, 4.6.0 ≤ v < 4.6.0.7 | 4.5.0.42, 4.6.0.7 |
| WSO2 WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.40, 4.6.0 ≤ v < 4.6.0.6 | 4.5.0.40, 4.6.0.6 |
| WSO2 WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.40, 4.6.0 ≤ v < 4.6.0.6 | 4.5.0.40, 4.6.0.6 |
| WSO2 WSO2 Carbon API Management Implementation | 9.20.74 ≤ v < 9.20.74.388, 9.28.116 ≤ v < 9.28.116.395, 9.29.120 ≤ v < 9.29.120.213, 9.30.67 ≤ v < 9.30.67.135, 9.31.86 ≤ v < 9.31.86.108, 9.32.147 ≤ v < 9.32.147.5 | 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5 |
| WSO2 WSO2 Carbon API Manager Rest API Utility | 9.20.74 ≤ v < 9.20.74.388, 9.28.116 ≤ v < 9.28.116.395, 9.29.120 ≤ v < 9.29.120.213, 9.30.67 ≤ v < 9.30.67.135, 9.31.86 ≤ v < 9.31.86.108, 9.32.147 ≤ v < 9.32.147.5 | 9.20.74.388, 9.28.116.395, 9.29.120.213, 9.30.67.135, 9.31.86.108, 9.32.147.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.