CVE-2025-14561: WSO2 API Control Plane

Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days.

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Affected products

  • WSO2 WSO2 API Control Plane: from 4.5.0, before 4.5.0.42 (fixed in 4.5.0.42); from 4.6.0, before 4.6.0.7 (fixed in 4.6.0.7)
  • WSO2 WSO2 API Manager: from 4.1.0, before 4.1.0.242 (fixed in 4.1.0.242); from 4.2.0, before 4.2.0.182 (fixed in 4.2.0.182); from 4.3.0, before 4.3.0.93 (fixed in 4.3.0.93); from 4.4.0, before 4.4.0.57 (fixed in 4.4.0.57); from 4.5.0, before 4.5.0.41 (fixed in 4.5.0.41); from 4.6.0, before 4.6.0.6 (fixed in 4.6.0.6)
  • WSO2 WSO2 Carbon API Management Implementation: from 9.20.74, before 9.20.74.388 (fixed in 9.20.74.388); from 9.28.116, before 9.28.116.395 (fixed in 9.28.116.395); from 9.29.120, before 9.29.120.213 (fixed in 9.29.120.213); from 9.30.67, before 9.30.67.135 (fixed in 9.30.67.135); from 9.31.86, before 9.31.86.108 (fixed in 9.31.86.108); from 9.32.147, before 9.32.147.5 (fixed in 9.32.147.5)
  • WSO2 WSO2 Carbon API Manager Rest API Utility: from 9.20.74, before 9.20.74.388 (fixed in 9.20.74.388); from 9.28.116, before 9.28.116.395 (fixed in 9.28.116.395); from 9.29.120, before 9.29.120.213 (fixed in 9.29.120.213); from 9.30.67, before 9.30.67.135 (fixed in 9.30.67.135); from 9.31.86, before 9.31.86.108 (fixed in 9.31.86.108); from 9.32.147, before 9.32.147.5 (fixed in 9.32.147.5)
  • WSO2 WSO2 Traffic Manager: from 4.5.0, before 4.5.0.40 (fixed in 4.5.0.40); from 4.6.0, before 4.6.0.6 (fixed in 4.6.0.6)
  • WSO2 WSO2 Universal Gateway: from 4.5.0, before 4.5.0.40 (fixed in 4.5.0.40); from 4.6.0, before 4.6.0.6 (fixed in 4.6.0.6)

Published 2026-08-06. Last modified 2026-09-29.