← CVE Intelligence

CVE-2025-9152

Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint PUBLISHED

Description (CNA)

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Affected (CNA)

Vendor / productVersions
WSO2 / WSO2 API Managerunknown 0 before 3.2.0; affected 3.2.0 before 3.2.0.437; affected 3.2.1 before 3.2.1.57; affected 4.0.0 before 4.0.0.357; affected 4.1.0 before 4.1.0.221; affected 4.2.0 before 4.2.0.159; affected 4.3.0 before 4.3.0.72; affected 4.4.0 before 4.4.0.35; affected 4.5.0 before 4.5.0.19
WSO2 / WSO2 API Control Planeaffected 4.5.0 before 4.5.0.20

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.