CVE-2025-14561

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-06 22:16

Updated : 2026-08-31 20:14

NVD link : CVE-2025-14561

Mitre link : CVE-2025-14561

CVE.ORG link : CVE-2025-14561

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-14561", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14561", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:48:07.717634Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.242", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.182", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.93", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.57", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.41", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.42", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.40", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.40", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon API Management Implementation", "versions": [{"status": "affected", "version": "9.20.74", "lessThan": "9.20.74.388", "versionType": "custom"}, {"status": "affected", "version": "9.28.116", "lessThan": "9.28.116.395", "versionType": "custom"}, {"status": "affected", "version": "9.29.120", "lessThan": "9.29.120.213", "versionType": "custom"}, {"status": "affected", "version": "9.30.67", "lessThan": "9.30.67.135", "versionType": "custom"}, {"status": "affected", "version": "9.31.86", "lessThan": "9.31.86.108", "versionType": "custom"}, {"status": "affected", "version": "9.32.147", "lessThan": "9.32.147.5", "versionType": "custom"}, {"status": "unaffected", "version": "9.32.160", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon API Manager Rest API Utility", "versions": [{"status": "affected", "version": "9.20.74", "lessThan": "9.20.74.388", "versionType": "custom"}, {"status": "affected", "version": "9.28.116", "lessThan": "9.28.116.395", "versionType": "custom"}, {"status": "affected", "version": "9.29.120", "lessThan": "9.29.120.213", "versionType": "custom"}, {"status": "affected", "version": "9.30.67", "lessThan": "9.30.67.135", "versionType": "custom"}, {"status": "affected", "version": "9.31.86", "lessThan": "9.31.86.108", "versionType": "custom"}, {"status": "affected", "version": "9.32.147", "lessThan": "9.32.147.5", "versionType": "custom"}, {"status": "unaffected", "version": "9.32.160", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util", "defaultStatus": "unknown"}]}], "published": "2026-08-06T22:16:41.420", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4918/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.\n\nThe vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments."}], "lastModified": "2026-08-31T20:14:36.250", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}