CVE-2025-11229: Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
The system fails to properly enforce scope authorization when the authorizeallscopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.
Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the authorizeallscopes configuration deviates from its default disabled state.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set authorize_all_scopes to its default disabled state to prevent client credentials applications from obtaining all API scopes without explicit authorization.
WSO2 Identity Server authorize_all_scopes = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when the `authorize_all_scopes` configuration is enabled. The description states that this setting is disabled by default, so deployments that retain the default configuration are not identified as affected.
What does an attacker need to exploit this issue?
An attacker needs an application that uses the client credentials grant type and can request scopes. The vulnerability allows such applications to obtain all API scopes without explicit authorization when `authorize_all_scopes` is enabled.
What is the practical impact of successful exploitation?
An unprivileged client can obtain sensitive internal and console scopes, bypass intended access controls, and perform unauthorized administrative actions or access confidential organizational data. In some deployments, this may lead to full account takeover.
What can be done if patching is not immediately possible?
Disable `authorize_all_scopes` if it is enabled, returning the deployment to the default disabled configuration described in the advisory. This prevents the condition that allows client-credentials applications to receive all scopes.