CVE-2025-11969

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 3.1.0 through 4.5.0 WSO2 Identity Server (affected versions not specified) WSO2 Open Banking AM (affected versions not specified) WSO2 IAM (affected versions not specified)

Description The System REST APIs fail to correctly enforce access control mechanisms. This allows users with lower privilege roles to execute unauthorized administrative actions and functions on the affected products. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this issue.

Recommendations Update WSO2 API Manager version 3.1.0 to 3.1.0.347 or higher. Update WSO2 API Manager version 3.2.0 to 3.2.0.450 or higher. For WSO2 Identity Server, Open Banking AM, and IAM, apply the latest WSO2 update level or higher.