CVE-2025-11969
CRITICAL
INFO
Priority: 0.03
BB Relevance:
79/100
Published: 2026-11-02
Modified: 2026-11-04
First seen: 2026-11-02
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
Low
Description
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
Weakness Classification (1)
Affected Software (68)
Showing 30 of 68 entries
References & Advisories (1)
vendor-advisory