CVE-2025-10611: wso2 api_control_plane Incorrect Authorization

CVSS: 9.8v3.1CriticalAnalyzed

Published 16-10-2025Last modified 16-10-2025

Vulnerability summary

CVE-2025-10611 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in wso2 api_control_plane. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.82%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

16-10-2025
PublishedVulnerability first disclosed.
16-10-2025
Last modifiedVulnerability information updated.

Description

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

Probability

0.82%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

0.00 pp

From 0.82% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.82%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected systems

Wso220 products

api_control_plane4.5.0
api_manager2.1.0 | 2.2.0 | 2.5.0 | 2.6.0 | 3.0.0 | 3.1.0 | 3.2.0 | 3.2.1 | 4.0.0 | 4.1.0 | 4.2.0 | 4.3.0 | 4.4.0 | 4.5.0
identity_server5.3.0 | 5.5.0 | 5.6.0 | 5.7.0 | 5.8.0 | 5.9.0 | 5.10.0 | 5.11.0 | 6.0.0 | 6.1.0 | 7.0.0 | 7.1.0
identity_server_as_key_manager5.3.0 | 5.5.0 | 5.6.0 | 5.7.0 | 5.9.0 | 5.10.0
open_banking_am1.4.0 | 1.5.0 | 2.0.0

open_banking_iam2.0.0
open_banking_km1.4.0 | 1.5.0
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service≥ 1.1.1, < 1.1.1.7 | ≥ 1.1.16, < 1.1.16.6 | ≥ 1.1.18, < 1.1.18.7 | ≥ 1.1.20, < 1.1.20.9 | ≥ 1.1.26, < 1.1.26.11 | ≥ 1.3.6, < 1.3.6.11 | ≥ 1.4.0, < 1.4.0.21 | ≥ 1.4.25, < 1.4.25.27 | ≥ 1.4.52, < 1.4.52.6 | ≥ 1.6.1, < 1.6.1.12 | ≥ 1.7.1, < 1.7.1.7 | ≥ 1.8.11, < 1.8.11.8 | ≥ 1.8.41, < 1.8.41.4 | ≥ 1.9.4, < 1.9.4.9 | ≥ 1.9.18, < 1.9.18.7 | ≥ 1.8, < 1.8.48
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve≥ 1.1.1, < 1.1.1.7 | ≥ 1.1.16, < 1.1.16.6 | ≥ 1.1.18, < 1.1.18.7 | ≥ 1.1.20, < 1.1.20.9 | ≥ 1.1.26, < 1.1.26.11 | ≥ 1.3.6, < 1.3.6.11 | ≥ 1.4.0, < 1.4.0.21 | ≥ 1.4.25, < 1.4.25.27 | ≥ 1.4.52, < 1.4.52.6 | ≥ 1.6.1, < 1.6.1.12 | ≥ 1.7.1, < 1.7.1.7 | ≥ 1.8.11, < 1.8.11.8 | ≥ 1.8.41, < 1.8.41.4 | ≥ 1.9.4, < 1.9.4.9 | ≥ 1.9.18, < 1.9.18.7 | ≥ 1.8, < 1.8.48
traffic_manager4.5.0
universal_gateway4.5.0
wso2 api control plane≥ 4.5.0, < 4.5.0.29
wso2 api manager≥ 2.1.0, < 2.1.0.42 | ≥ 2.2.0, < 2.2.0.61 | ≥ 2.5.0, < 2.5.0.87 | ≥ 2.6.0, < 2.6.0.148 | ≥ 3.0.0, < 3.0.0.178 | ≥ 3.1.0, < 3.1.0.345 | ≥ 3.2.0, < 3.2.0.446 | ≥ 3.2.1, < 3.2.1.66 | ≥ 4.0.0, < 4.0.0.366 | ≥ 4.1.0, < 4.1.0.228 | ≥ 4.2.0, < 4.2.0.169 | ≥ 4.3.0, < 4.3.0.81 | ≥ 4.4.0, < 4.4.0.45 | ≥ 4.5.0, < 4.5.0.28
wso2 identity server≥ 5.3.0, < 5.3.0.39 | ≥ 5.5.0, < 5.5.0.54 | ≥ 5.6.0, < 5.6.0.62 | ≥ 5.7.0, < 5.7.0.128 | ≥ 5.8.0, < 5.8.0.112 | ≥ 5.9.0, < 5.9.0.171 | ≥ 5.10.0, < 5.10.0.375 | ≥ 5.11.0, < 5.11.0.419 | ≥ 6.0.0, < 6.0.0.248 | ≥ 6.1.0, < 6.1.0.248 | ≥ 7.0.0, < 7.0.0.124 | ≥ 7.1.0, < 7.1.0.31
wso2 identity server as key manager≥ 5.3.0, < 5.3.0.44 | ≥ 5.5.0, < 5.5.0.55 | ≥ 5.6.0, < 5.6.0.77 | ≥ 5.7.0, < 5.7.0.127 | ≥ 5.9.0, < 5.9.0.178 | ≥ 5.10.0, < 5.10.0.365
wso2 open banking am≥ 1.4.0, < 1.4.0.141 | ≥ 1.5.0, < 1.5.0.142 | ≥ 2.0.0, < 2.0.0.394
wso2 open banking iam≥ 2.0.0, < 2.0.0.414
wso2 open banking km≥ 1.4.0, < 1.4.0.135 | ≥ 1.5.0, < 1.5.0.125
wso2 traffic manager≥ 4.5.0, < 4.5.0.27
wso2 universal gateway≥ 4.5.0, < 4.5.0.27

Show all 20

1 vendor · 20 products

References

1 links

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/Vendor Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities