CVE-2025-9152

The DCR endpoint in the keymanager-operations component does not require authentication or authorization (CWE-306: Missing Authentication for Critical Function). An attacker can directly send requests to this endpoint over the network without providing any authentication credentials. As a result, it is possible to generate access tokens with elevated privileges, which can subsequently be used to perform unauthorized administrative operations in the system.

An attacker can obtain access tokens with administrative privileges and perform arbitrary unauthorized operations in the system, leading to complete breach of confidentiality, integrity, and availability of the API Manager platform.

Apply patches available from the vendor according to the references — detailed information about patched versions is contained in the WSO2 security advisory available at: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/

WSO2 API Manager and WSO2 API Control Plane — specific versions indicated in vendor references (WSO2-2025-4483)