EUVD Vulnerability Catalog

EUVD-2025-211233

Severity: CRITICAL Base Score: 9.4 CVSS Version: 3.1

Vulnerability Description

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): Low

Affected Vendors & Systems

Vendor WSO2

References & Advisory Links

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

WSO2

EPSS Probability

Known Aliases

GHSA-p4rq-q6fh-965p CVE-2025-11969

Published On

2026-11-02

Last Updated

2026-11-02