CVE-2025-10611: Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Published Oct 16, 2025

Updated

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.

Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

Affected Software

42 affected components

WSO2 WSO2 Products

WSO2 Api Control Plane=4.5.0

WSO2 API Manager=2.1.0

WSO2 API Manager=2.2.0

WSO2 API Manager=2.5.0

WSO2 API Manager=2.6.0

WSO2 API Manager=3.0.0

WSO2 API Manager=3.1.0

WSO2 API Manager=3.2.0

WSO2 API Manager=3.2.1

WSO2 API Manager=4.0.0

WSO2 API Manager=4.1.0

WSO2 API Manager=4.2.0

WSO2 API Manager=4.3.0

WSO2 API Manager=4.4.0

WSO2 API Manager=4.5.0

WSO2 Identity Server=5.3.0

WSO2 Identity Server=5.5.0

WSO2 Identity Server=5.6.0

WSO2 Identity Server=5.7.0

WSO2 Identity Server=5.8.0

WSO2 Identity Server=5.9.0

WSO2 Identity Server=5.10.0

WSO2 Identity Server=5.11.0

WSO2 Identity Server=6.0.0

WSO2 Identity Server=6.1.0

WSO2 Identity Server=7.0.0

WSO2 Identity Server=7.1.0

WSO2 Identity Server as Key Manager=5.3.0

WSO2 Identity Server as Key Manager=5.5.0

WSO2 Identity Server as Key Manager=5.6.0

WSO2 Identity Server as Key Manager=5.7.0

WSO2 Identity Server as Key Manager=5.9.0

WSO2 Identity Server as Key Manager=5.10.0

WSO2 Open Banking AM=1.4.0

WSO2 Open Banking AM=1.5.0

WSO2 Open Banking AM=2.0.0

WSO2 Open Banking Iam=2.0.0

WSO2 Open Banking KM=1.4.0

WSO2 Open Banking KM=1.5.0

WSO2 Traffic Manager=4.5.0

WSO2 Universal Gateway=4.5.0

Remediation

Information

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution

Event History

Oct 16, 2025

CVE Published

via MITRE·12:09 PM

Data Sourced

via MITRE·12:09 PM

RemedyDescriptionSeverity

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10611?

CVE-2025-10611 is classified as a high-severity vulnerability due to its potential for authentication and authorization bypass.

How do I fix CVE-2025-10611?

To fix CVE-2025-10611, ensure that proper access control measures are implemented for the affected REST APIs in WSO2 Products.

What types of WSO2 Products are affected by CVE-2025-10611?

CVE-2025-10611 affects multiple WSO2 Products that expose certain REST APIs without sufficient access controls.

What are the risks associated with exploiting CVE-2025-10611?

Exploitation of CVE-2025-10611 may allow unauthorized users to access sensitive functions of WSO2 Products, leading to data breaches.

Is there a patch available for CVE-2025-10611?

Yes, WSO2 has released a patch that addresses the access control issues related to CVE-2025-10611.