WSO2 Products Improper Access Control Vulnerability in Internal APIs

A vulnerability allowing improper access control has been identified in multiple WSO2 products. This issue arises from inadequate permission enforcement in certain internal SOAP Admin Services and System REST APIs, allowing low-privileged users to perform unauthorized operations, such as accessing server-level information. The vulnerability is limited to internal administrative interfaces, with APIs exposed through the WSO2 API Manager's API Gateway remaining unaffected.

Impact

Exploitation of this vulnerability could enable unauthorized users to perform restricted actions or access sensitive server-level information on the affected WSO2 product.

Remediation

Users can apply the relevant fixes available on GitHub for their specific WSO2 product version. For WSO2 Support Subscription Holders, updates can be applied through the WSO2 Updates service.