WSO2 Carbon API Manager Rest API Common Functions vulnerabilities

1 vulnerability

Known vulnerabilities in WSO2 Carbon API Manager Rest API Common Functions, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2026-1728wso2api_control_plane+9
EPSS score
0.48%
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.