critical9.8
CVE-2026-1728
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Impact
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Control Plane | from 4.5.0 before 4.5.0.49 from 4.6.0 before 4.6.0.13 |
| Wso2 | Api Manager | from 4.0.0 before 4.0.0.384 from 4.1.0 before 4.1.0.248 from 4.2.0 before 4.2.0.188 from 4.3.0 before 4.3.0.99 from 4.4.0 before 4.4.0.63 from 4.5.0 before 4.5.0.48 |
| Wso2 | Traffic Manager | from 4.5.0 before 4.5.0.47 from 4.6.0 before 4.6.0.12 |
| Wso2 | Universal Gateway | from 4.5.0 before 4.5.0.48 from 4.6.0 before 4.6.0.12 |