CVE-2025-10611

CRITICAL

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without pr...

Affects 9 products across 1 vendor.

CVSS 3.19.8
EPSS0.8%
Percentile56th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-863: Incorrect Authorization

Software performs an authorization check incorrectly, allowing access beyond intended privileges.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in multiple WSO2 Products due to insufficient access control allows unauthorized access to administrative functionalities via certain REST APIs.

BSID: BS-2025-GLOBAL-228966-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-10611?
A critical vulnerability in multiple WSO2 Products due to insufficient access control allows unauthorized access to administrative functionalities via certain REST APIs.
What is the CVSS score for CVE-2025-10611?
CVE-2025-10611 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2025-10611 actively exploited?
No confirmed active exploitation of CVE-2025-10611 as of 2026-09-25.
How do I remediate CVE-2025-10611?
Priority: IMMEDIATE. Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/ PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
What systems are affected by CVE-2025-10611?
CVE-2025-10611 affects Wso2 Identity Server, Api Manager, Identity Server As Key Manager, Open Banking Am, Open Banking Iam, Open Banking Km, Api Control Plane, Traffic Manager, Universal Gateway.
Vulnerability Details
CVE IDCVE-2025-10611
BSIDBS-2025-GLOBAL-228966-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-10-16
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Incorrect Authorization
SourceNVD
Official Description

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from inadequate authentication and authorization checks for specific REST APIs, enabling attackers to bypass these controls and perform administrative actions without proper validation.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Wso2 Identity Server 5.3.0 5.5.0 5.6.0 5.7.0 5.8.0 5.9.0
+6 more5.10.0 5.11.0 6.0.0 6.1.0 7.0.0 7.1.0
Wso2 Api Manager 2.1.0 2.2.0 2.5.0 2.6.0 3.0.0 3.1.0
+8 more3.2.0 3.2.1 4.0.0 4.1.0 4.2.0 4.3.0 4.4.0 4.5.0
Wso2 Identity Server As Key Manager 5.3.0 5.5.0 5.6.0 5.7.0 5.9.0 5.10.0
Wso2 Open Banking Am 1.4.0 1.5.0 2.0.0
Wso2 Open Banking Iam 2.0.0
Wso2 Open Banking Km 1.4.0 1.5.0
Wso2 Api Control Plane 4.5.0
Wso2 Traffic Manager 4.5.0
Wso2 Universal Gateway 4.5.0
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: ed10eef1-636d-4fbe-9993-6890dfa878f8
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 364 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashdb38bd08920a4aaafbbeaa320785683b09dce6b741bca3503a32297b4cb7ec1487ca82d9d6e2eb8f855f7ddff132e17091b5a7c7e2ecec3f48a9a36e8b73e50b
Related CVEs affecting Wso2
CVE-2026-5430 10.0 The JWT authentication mechanism accepts tokens signed with algorithms other ... CVE-2026-2053 10.0 The WSO2 API Manager's message flow component, when processing WS-Addressing ... CVE-2025-9152 9.8 An improper privilege management vulnerability exists in WSO2 API Manager due... CVE-2020-13226 9.8 WSO2 API Manager 3.0.0 does not properly restrict outbound network access fro... CVE-2022-29464 9.8 Certain WSO2 products allow unrestricted file upload with resultant remote co...
View all Wso2 CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →