CVE-2025-14779: Improper Access Control via Secret Type Management API in WSO2 Identity Server
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations.
Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure delete permissions for the WSO2 Identity Server Secret Type Management REST API are not broadly granted; restrict delete access so only the minimum required administrators can perform deletes.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14779?
The severity of CVE-2025-14779 is classified as low with a score of 3.8.
How do I fix CVE-2025-14779?
To fix CVE-2025-14779, ensure that access controls are properly configured for the Secret Type Management REST API and test the on-delete cascade logic.
What are the potential impacts of CVE-2025-14779?
CVE-2025-14779 can lead to the unintended deletion of secrets associated with a secret type across all organizations.
Which software is affected by CVE-2025-14779?
CVE-2025-14779 affects the WSO2 Identity Server.
When was CVE-2025-14779 published?
CVE-2025-14779 was published on August 6, 2026.