CVE-2026-4052

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0

Description A privilege escalation issue exists where a self-registered user can gain unauthorized access to the System REST APIs. This occurs in deployments where WSO2 Identity Server is configured as a Resident Key Manager and shares a database with WSO2 API Manager. An attacker can achieve this by obtaining a token from the WSO2 Identity Server token endpoint.

Recommendations Update WSO2 API Manager to version 1.8.8.