CVE-2026-1728 PUBLISHED

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Assigner: WSO2
Reserved: 31.01.2026 Published: 06.08.2026 Updated: 06.08.2026

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor WSO2
Product WSO2 API Manager
Versions Default: unaffected
  • unknown from 0 to 4.0.0 (excl.)
  • affected from 4.0.0 to 4.0.0.384 (excl.)
  • affected from 4.1.0 to 4.1.0.248 (excl.)
  • affected from 4.2.0 to 4.2.0.188 (excl.)
  • affected from 4.3.0 to 4.3.0.99 (excl.)
  • affected from 4.4.0 to 4.4.0.63 (excl.)
  • affected from 4.5.0 to 4.5.0.48 (excl.)
  • affected from 4.6.0 to 4.6.0.12 (excl.)
Vendor WSO2
Product WSO2 API Control Plane
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.49 (excl.)
  • affected from 4.6.0 to 4.6.0.13 (excl.)
Vendor WSO2
Product WSO2 Universal Gateway
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.48 (excl.)
  • affected from 4.6.0 to 4.6.0.12 (excl.)
Vendor WSO2
Product WSO2 Traffic Manager
Versions Default: unaffected
  • affected from 4.5.0 to 4.5.0.47 (excl.)
  • affected from 4.6.0 to 4.6.0.12 (excl.)
Vendor WSO2
Product WSO2 Carbon API Manager Rest API Common Functions
Versions Default: unknown
  • affected from 9.0.174 to 9.0.174.550 (excl.)
  • affected from 9.28.116 to 9.28.116.404 (excl.)
  • affected from 9.29.120 to 9.29.120.221 (excl.)
  • affected from 9.30.67 to 9.30.67.146 (excl.)
  • affected from 9.31.86 to 9.31.86.130 (excl.)
  • affected from 9.32.147 to 9.32.147.26 (excl.)
  • unaffected from 9.33.27 to * (incl.)
Vendor WSO2
Product WSO2 Carbon API Manager Rest API Utility
Versions Default: unknown
  • affected from 9.20.74 to 9.20.74.392 (excl.)
  • unaffected from 9.33.27 to * (incl.)

Solutions

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/#solution

References

Problem Types

  • CWE-269: Improper Privilege Management CWE

Impacts

  • CAPEC-20 CAPEC-20: Accessing Resources with Insufficient Authorization