Zero Radar
← feed
CriticalVulnerabilityCVE-2025-11969updated 2 Nov 2026, 06:21 UTC

WSO2 System REST APIs let lower-privilege users run admin actions

Some users with limited accounts can perform actions that should be reserved for administrators. This can let them change things they should not be able to change.

NewOfficial source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

What happened

The System REST APIs in an affected WSO2 product do not correctly enforce access control, allowing users with lower-privilege roles to execute administrative functions.

Why it is dangerous: A user with a basic account could carry out administrative operations, potentially altering configuration or control of the system. Organizations running affected WSO2 products with multiple user roles are at risk.

Are you affected?

You are affected if you run a WSO2 product with System REST APIs exposed and have users with lower-privilege roles; the product and versions are not specified in the provided material.

WSO2 product with System REST APIs (specific product names and versions not stated). APIs exposed through the WSO2 API Manager's API Gateway are not affected.

What to do

  1. Check whether your WSO2 product exposes System REST APIs and which user roles have access.
  2. Restrict access to System REST APIs to trusted administrators only, pending an official fix.
  3. Check the WSO2 security advisory for CVE-2025-11969 for patched versions and apply them.

Timeline

  1. 2 Nov 2026, 06:17 UTC
    Publicly disclosed
  2. 2 Nov 2026, 06:17 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 06:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2025-11969
CVSS
9.4 / 10
Disclosed
2 Nov 2026, 06:17 UTC
On Zero Radar
2 Nov 2026, 06:21 UTC (3 min after disclosure)
Last change
2 Nov 2026, 06:21 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WSO2 System REST APIs let lower-privilege users run admin actions · Zero Radar