CVE-2025-9152: api control plane 4.5.0; +3 more affected products

Affected technology

api control plane · 4.5.0
wso2

api manager · 3.2.0
wso2

api manager · 3.2.1
wso2

api manager · 4.0.0
wso2

api manager · 4.1.0
wso2

api manager · 4.2.0
wso2

api manager · 4.3.0
wso2

api manager · 4.4.0
wso2

api manager · 4.5.0
wso2

WSO2 API Manager · 3.2.0 to before 3.2.0.437, 3.2.1 to before 3.2.1.57, 4.0.0 to before 4.0.0.357, 4.1.0 to before 4.1.0.221, 4.2.0 to before 4.2.0.159, 4.3.0 to before 4.3.0.72, 4.4.0 to before 4.4.0.35, 4.5.0 to before 4.5.0.19
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.20
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.