https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:37:16 +0000 https://vulnerability.circl.lu/vuln/cve-2025-14779 <p><strong>Affected:</strong> WSO2 Identity Server, WSO2 Carbon Identity API Server Secret Management Common, WSO2 Carbon Identity API Server Secret Management V1</p> <p>The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations.</p> <p>Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.</p> <p><strong>Affected:</strong> WSO2 Identity Server, WSO2 Carbon Identity API Server Secret Management Common, WSO2 Carbon Identity API Server Secret Management V1</p> <p>The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations.</p> <p>Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.</p> https://vulnerability.circl.lu/vuln/cve-2025-14779