CVE-2025-10611 - Vulnerability Details - OpenCVE

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/

History

Thu, 16 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-863
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 16 Oct 2025 12:30:00 +0000

Type	Values Removed	Values Added
Description		Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
Title		Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2025-10-16T12:09:31.802Z

Updated: 2025-10-16T13:34:31.799Z

Reserved: 2025-09-17T08:56:27.794Z

Link: CVE-2025-10611

Vulnrichment

Updated: 2025-10-16T13:24:43.729Z

NVD

Status : Received

Published: 2025-10-16T13:15:40.640

Modified: 2025-10-16T14:15:34.520

Link: CVE-2025-10611

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10611", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-09-17T08:56:27.794Z", "datePublished": "2025-10-16T12:09:31.802Z", "dateUpdated": "2025-10-16T13:34:31.799Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "2.1.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.1.0.42", "status": "affected", "version": "2.1.0", "versionType": "custom"}, {"lessThan": "2.2.0.61", "status": "affected", "version": "2.2.0", "versionType": "custom"}, {"lessThan": "2.5.0.87", "status": "affected", "version": "2.5.0", "versionType": "custom"}, {"lessThan": "2.6.0.148", "status": "affected", "version": "2.6.0", "versionType": "custom"}, {"lessThan": "3.0.0.178", "status": "affected", "version": "3.0.0", "versionType": "custom"}, {"lessThan": "3.1.0.345", "status": "affected", "version": "3.1.0", "versionType": "custom"}, {"lessThan": "3.2.0.446", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.66", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.366", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.228", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.169", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.81", "status": "affected", "version": "4.3.0", "versionType": "custom"}, {"lessThan": "4.4.0.45", "status": "affected", "version": "4.4.0", "versionType": "custom"}, {"lessThan": "4.5.0.28", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 API Control Plane", "vendor": "WSO2", "versions": [{"lessThan": "4.5.0.29", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking AM", "vendor": "WSO2", "versions": [{"lessThan": "1.4.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "1.4.0.141", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.5.0.142", "status": "affected", "version": "1.5.0", "versionType": "custom"}, {"lessThan": "2.0.0.394", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking IAM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.414", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.3.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.3.0.39", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThan": "5.5.0.54", "status": "affected", "version": "5.5.0", "versionType": "custom"}, {"lessThan": "5.6.0.62", "status": "affected", "version": "5.6.0", "versionType": "custom"}, {"lessThan": "5.7.0.128", "status": "affected", "version": "5.7.0", "versionType": "custom"}, {"lessThan": "5.8.0.112", "status": "affected", "version": "5.8.0", "versionType": "custom"}, {"lessThan": "5.9.0.171", "status": "affected", "version": "5.9.0", "versionType": "custom"}, {"lessThan": "5.10.0.375", "status": "affected", "version": "5.10.0", "versionType": "custom"}, {"lessThan": "5.11.0.419", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.248", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.248", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "7.0.0.124", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "7.1.0.31", "status": "affected", "version": "7.1.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server as Key Manager", "vendor": "WSO2", "versions": [{"lessThan": "5.3.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.3.0.44", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThan": "5.5.0.55", "status": "affected", "version": "5.5.0", "versionType": "custom"}, {"lessThan": "5.6.0.77", "status": "affected", "version": "5.6.0", "versionType": "custom"}, {"lessThan": "5.7.0.127", "status": "affected", "version": "5.7.0", "versionType": "custom"}, {"lessThan": "5.9.0.178", "status": "affected", "version": "5.9.0", "versionType": "custom"}, {"lessThan": "5.10.0.365", "status": "affected", "version": "5.10.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking KM", "vendor": "WSO2", "versions": [{"lessThan": "1.4.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "1.4.0.135", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.5.0.125", "status": "affected", "version": "1.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Universal Gateway", "vendor": "WSO2", "versions": [{"lessThan": "4.5.0.27", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Traffic Manager", "vendor": "WSO2", "versions": [{"lessThan": "4.5.0.27", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service", "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service", "vendor": "WSO2", "versions": [{"lessThan": "1.1.1.7", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.1.16.6", "status": "affected", "version": "1.1.16", "versionType": "custom"}, {"lessThan": "1.1.18.7", "status": "affected", "version": "1.1.18", "versionType": "custom"}, {"lessThan": "1.1.20.9", "status": "affected", "version": "1.1.20", "versionType": "custom"}, {"lessThan": "1.1.26.11", "status": "affected", "version": "1.1.26", "versionType": "custom"}, {"lessThan": "1.3.6.11", "status": "affected", "version": "1.3.6", "versionType": "custom"}, {"lessThan": "1.4.0.21", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.4.25.27", "status": "affected", "version": "1.4.25", "versionType": "custom"}, {"lessThan": "1.4.52.6", "status": "affected", "version": "1.4.52", "versionType": "custom"}, {"lessThan": "1.6.1.12", "status": "affected", "version": "1.6.1", "versionType": "custom"}, {"lessThan": "1.7.1.7", "status": "affected", "version": "1.7.1", "versionType": "custom"}, {"lessThan": "1.8.11.8", "status": "affected", "version": "1.8.11", "versionType": "custom"}, {"lessThan": "1.8.41.4", "status": "affected", "version": "1.8.41", "versionType": "custom"}, {"lessThan": "1.9.4.9", "status": "affected", "version": "1.9.4", "versionType": "custom"}, {"lessThan": "1.9.18.7", "status": "affected", "version": "1.9.18", "versionType": "custom"}, {"lessThan": "1.8.48", "status": "affected", "version": "1.8", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "1.9.46", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve", "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve", "vendor": "WSO2", "versions": [{"lessThan": "1.1.1.7", "status": "affected", "version": "1.1.1", "versionType": "custom"}, {"lessThan": "1.1.16.6", "status": "affected", "version": "1.1.16", "versionType": "custom"}, {"lessThan": "1.1.18.7", "status": "affected", "version": "1.1.18", "versionType": "custom"}, {"lessThan": "1.1.20.9", "status": "affected", "version": "1.1.20", "versionType": "custom"}, {"lessThan": "1.1.26.11", "status": "affected", "version": "1.1.26", "versionType": "custom"}, {"lessThan": "1.3.6.11", "status": "affected", "version": "1.3.6", "versionType": "custom"}, {"lessThan": "1.4.0.21", "status": "affected", "version": "1.4.0", "versionType": "custom"}, {"lessThan": "1.4.25.27", "status": "affected", "version": "1.4.25", "versionType": "custom"}, {"lessThan": "1.4.52.6", "status": "affected", "version": "1.4.52", "versionType": "custom"}, {"lessThan": "1.6.1.12", "status": "affected", "version": "1.6.1", "versionType": "custom"}, {"lessThan": "1.7.1.7", "status": "affected", "version": "1.7.1", "versionType": "custom"}, {"lessThan": "1.8.11.8", "status": "affected", "version": "1.8.11", "versionType": "custom"}, {"lessThan": "1.8.41.4", "status": "affected", "version": "1.8.41", "versionType": "custom"}, {"lessThan": "1.9.4.9", "status": "affected", "version": "1.9.4", "versionType": "custom"}, {"lessThan": "1.9.18.7", "status": "affected", "version": "1.9.18", "versionType": "custom"}, {"lessThan": "1.8.48", "status": "affected", "version": "1.8", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "1.9.46", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.<br><br>Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.<br>"}], "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2025-10-16T12:09:31.802Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution</span></a> <br>"}], "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution"}], "source": {"advisory": "WSO2-2025-4585", "discovery": "INTERNAL"}, "title": "Potential Broken Access Control in Multiple WSO2 Products via System REST APIs", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T13:24:33.931504Z", "id": "CVE-2025-10611", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:34:31.799Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10611", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-16T13:24:33.931504Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:24:43.729Z"}}], "cna": {"title": "Potential Broken Access Control in Multiple WSO2 Products via System REST APIs", "source": {"advisory": "WSO2-2025-4585", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.1.0", "versionType": "custom"}, {"status": "affected", "version": "2.1.0", "lessThan": "2.1.0.42", "versionType": "custom"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.0.61", "versionType": "custom"}, {"status": "affected", "version": "2.5.0", "lessThan": "2.5.0.87", "versionType": "custom"}, {"status": "affected", "version": "2.6.0", "lessThan": "2.6.0.148", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.0.178", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.345", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.446", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.66", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.366", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.228", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.169", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.81", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.45", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.28", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.29", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.4.0", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.141", "versionType": "custom"}, {"status": "affected", "version": "1.5.0", "lessThan": "1.5.0.142", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.394", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.414", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.3.0", "versionType": "custom"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.0.39", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.0.54", "versionType": "custom"}, {"status": "affected", "version": "5.6.0", "lessThan": "5.6.0.62", "versionType": "custom"}, {"status": "affected", "version": "5.7.0", "lessThan": "5.7.0.128", "versionType": "custom"}, {"status": "affected", "version": "5.8.0", "lessThan": "5.8.0.112", "versionType": "custom"}, {"status": "affected", "version": "5.9.0", "lessThan": "5.9.0.171", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.375", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.419", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.248", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.248", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.124", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.31", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.3.0", "versionType": "custom"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.0.44", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.0.55", "versionType": "custom"}, {"status": "affected", "version": "5.6.0", "lessThan": "5.6.0.77", "versionType": "custom"}, {"status": "affected", "version": "5.7.0", "lessThan": "5.7.0.127", "versionType": "custom"}, {"status": "affected", "version": "5.9.0", "lessThan": "5.9.0.178", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.365", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking KM", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.4.0", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.135", "versionType": "custom"}, {"status": "affected", "version": "1.5.0", "lessThan": "1.5.0.125", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.27", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.27", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service", "versions": [{"status": "affected", "version": "1.1.1", "lessThan": "1.1.1.7", "versionType": "custom"}, {"status": "affected", "version": "1.1.16", "lessThan": "1.1.16.6", "versionType": "custom"}, {"status": "affected", "version": "1.1.18", "lessThan": "1.1.18.7", "versionType": "custom"}, {"status": "affected", "version": "1.1.20", "lessThan": "1.1.20.9", "versionType": "custom"}, {"status": "affected", "version": "1.1.26", "lessThan": "1.1.26.11", "versionType": "custom"}, {"status": "affected", "version": "1.3.6", "lessThan": "1.3.6.11", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.21", "versionType": "custom"}, {"status": "affected", "version": "1.4.25", "lessThan": "1.4.25.27", "versionType": "custom"}, {"status": "affected", "version": "1.4.52", "lessThan": "1.4.52.6", "versionType": "custom"}, {"status": "affected", "version": "1.6.1", "lessThan": "1.6.1.12", "versionType": "custom"}, {"status": "affected", "version": "1.7.1", "lessThan": "1.7.1.7", "versionType": "custom"}, {"status": "affected", "version": "1.8.11", "lessThan": "1.8.11.8", "versionType": "custom"}, {"status": "affected", "version": "1.8.41", "lessThan": "1.8.41.4", "versionType": "custom"}, {"status": "affected", "version": "1.9.4", "lessThan": "1.9.4.9", "versionType": "custom"}, {"status": "affected", "version": "1.9.18", "lessThan": "1.9.18.7", "versionType": "custom"}, {"status": "affected", "version": "1.8", "lessThan": "1.8.48", "versionType": "custom"}, {"status": "unaffected", "version": "1.9.46", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve", "versions": [{"status": "affected", "version": "1.1.1", "lessThan": "1.1.1.7", "versionType": "custom"}, {"status": "affected", "version": "1.1.16", "lessThan": "1.1.16.6", "versionType": "custom"}, {"status": "affected", "version": "1.1.18", "lessThan": "1.1.18.7", "versionType": "custom"}, {"status": "affected", "version": "1.1.20", "lessThan": "1.1.20.9", "versionType": "custom"}, {"status": "affected", "version": "1.1.26", "lessThan": "1.1.26.11", "versionType": "custom"}, {"status": "affected", "version": "1.3.6", "lessThan": "1.3.6.11", "versionType": "custom"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.0.21", "versionType": "custom"}, {"status": "affected", "version": "1.4.25", "lessThan": "1.4.25.27", "versionType": "custom"}, {"status": "affected", "version": "1.4.52", "lessThan": "1.4.52.6", "versionType": "custom"}, {"status": "affected", "version": "1.6.1", "lessThan": "1.6.1.12", "versionType": "custom"}, {"status": "affected", "version": "1.7.1", "lessThan": "1.7.1.7", "versionType": "custom"}, {"status": "affected", "version": "1.8.11", "lessThan": "1.8.11.8", "versionType": "custom"}, {"status": "affected", "version": "1.8.41", "lessThan": "1.8.41.4", "versionType": "custom"}, {"status": "affected", "version": "1.9.4", "lessThan": "1.9.4.9", "versionType": "custom"}, {"status": "affected", "version": "1.9.18", "lessThan": "1.9.18.7", "versionType": "custom"}, {"status": "affected", "version": "1.8", "lessThan": "1.8.48", "versionType": "custom"}, {"status": "unaffected", "version": "1.9.46", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.", "supportingMedia": [{"type": "text/html", "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.<br><br>Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.<br>", "base64": false}]}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2025-10-16T12:09:31.802Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10611", "state": "PUBLISHED", "dateUpdated": "2025-10-16T13:34:31.799Z", "dateReserved": "2025-09-17T08:56:27.794Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2025-10-16T12:09:31.802Z", "assignerShortName": "WSO2"}, "dataVersion": "5.1"}