CVE-2025-13475: Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing.
This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WSO2 (per WSO2-2025-1613 security advisory)to a version that resolves this vulnerability.Patch WSO2-2025-1613
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13475?
The severity of CVE-2025-13475 is classified as low, with a score of 3.5.
How does CVE-2025-13475 affect data security in WSO2 products?
CVE-2025-13475 allows unauthorized data exposure due to mismanagement of application consent across tenants.
What are the potential impacts of CVE-2025-13475?
The potential impact of CVE-2025-13475 includes unauthorized access to data across different tenants in multi-tenanted WSO2 deployments.
How can I mitigate the risks associated with CVE-2025-13475?
To mitigate CVE-2025-13475, ensure proper isolation of consent scopes and review application consent configurations for multi-tenanted WSO2 deployments.
Who is affected by CVE-2025-13475?
CVE-2025-13475 affects users of multiple WSO2 products that are configured in a multi-tenant environment.