CVE-2025-11969: Critical severity vulnerability

Published Nov 2, 2026

Updated

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.

Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

Event History

Nov 2, 2026

CVE Published

via NVD·06:17 AM

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs access as a user with a lower-privilege role. No additional privileges or user interaction are indicated in the available data.

Are APIs published through the API Gateway affected?

No. APIs exposed through the WSO2 API Manager API Gateway are explicitly excluded from the affected attack surface.

What could a successful attacker do?

A lower-privileged user could execute administrative actions and other administrative functions that should be restricted, potentially resulting in unauthorized operations.

CVE-2025-11969: Critical severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

Are APIs published through the API Gateway affected?

What could a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are APIs published through the API Gateway affected?

What could a successful attacker do?