CVE-2025-10611

The vulnerability consists of insufficient access control implementation (CWE-863 – improper authorization) in the REST API request handling layer. An attacker can invoke protected API endpoints without providing valid authentication credentials or possessing required permissions. Requests directed to these APIs do not undergo proper identity validation and permission level checks, resulting in full access to administrative operations.

An attacker without any privileges can gain administrative access to the system and perform unauthorized management operations, including potentially modifying configuration, managing users, and controlling critical identity platform and open banking functions.

Security patches available from the vendor must be applied according to the references — detailed information about patched versions is contained in the official WSO2 security bulletin at: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/

WSO2 Open Banking AM, WSO2 Open Banking KM, WSO2 Traffic Manager, WSO2 Open Banking IAM, WSO2 Identity Server — versions specified in vendor references (advisory WSO2-2025-4585)