https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T18:53:24.899443+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-14561 CVE-2025-14561 — Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations 2026-10-07T18:53:24.917627+00:00

Affected: WSO2 API Manager, WSO2 API Control Plane, WSO2 Traffic Manager, WSO2 Universal Gateway, WSO2 Carbon API Management Implementation, WSO2 Carbon API Manager Rest API Utility

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.

The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.