CVE-2026-4052
Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
| CWE | CWE-862 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new critical vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
WSO2 / WSO2 API Manager
4.1.0 4.2.0 4.3.0 4.4.0 4.5.0 4.6.0
WSO2 / WSO2 API Control Plane
4.5.0 4.6.0
WSO2 / WSO2 Identity Server Key Manager Connector (apim-km-wso2is)
0 < 1.8.8