CVE-2025-13475: In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a…

PriorityP344high7.3CVSS 3.1

AVNACLPRLUIRSUCHIHAN

EPSS

0.27%

18.5th percentile

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
wso2	api_manager	>= 3.2.0 < 3.2.0.457	3.2.0.457
wso2	api_manager	>= 3.2.1 < 3.2.1.76	3.2.1.76
wso2	identity_server	>= 5.10.0 < 5.10.0.382	5.10.0.382
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.457	3.2.0.457
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.76	3.2.1.76
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.382	5.10.0.382

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.