WSO2 Carbon API Manager Rest API Common Functions vulnerabilities

2 known vulnerabilities in WSO2 Carbon API Manager Rest API Common Functions from WSO2. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  WSO2 API Manager: Improper Authorization

  CVE-2025-11969Nov 2, 2026WSO2

  The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful ex

• 9.8 Critical severity

  WSO2 API Manager: Improper Privilege Management

  CVE-2026-1728Aug 6, 2026WSO2

  Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentiall