CVE-2023-6835: WSO2 API Manager

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Affected products

• WSO2 API Manager: version 2.2.0 only; version 2.5.0 only; version 2.6.0 only
• WSO2 IoT Server: version 3.3.1 only

Published 2023-12-15. Last modified 2026-06-17.