CVE-2025-14779: wso2 identity_server Improper Preservation of Permissions
Vulnerability summary
CVE-2025-14779 is a low (CVSS 3.8) Improper Preservation of Permissions vulnerability in wso2 identity_server. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.3% of scored vulnerabilities.
Timeline
- 06-08-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST3.8LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.13 pp
From 0.19% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso24 products
- identity_server≥ 6.0.0, < 6.0.0.261 | ≥ 6.1.0, < 6.1.0.262 | ≥ 7.1.0, < 7.1.0.46
- wso2 carbon identity api server secret management common≥ 1.2.3, < 1.2.3.7 | ≥ 1.2.23, < 1.2.23.11 | ≥ 1.3.83, < 1.3.83.16
- wso2 carbon identity api server secret management v1≥ 1.2.3, < 1.2.3.7 | ≥ 1.2.23, < 1.2.23.11 | ≥ 1.3.83, < 1.3.83.16
- wso2 identity server≥ 6.0.0, < 6.0.0.261 | ≥ 6.1.0, < 6.1.0.262 | ≥ 7.1.0, < 7.1.0.46
1 vendor · 4 products