CVE-2025-14561

published 2026-08-06

CVE-2025-14561: In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient…

Priority P3 52 critical 9 CVSS 3.1

AV N AC L PR H UI N S C C H I H A L

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.

The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.42	4.5.0.42
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.7	4.6.0.7
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.242	4.1.0.242
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.182	4.2.0.182
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.93	4.3.0.93
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.57	4.4.0.57
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.41	4.5.0.41
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.6	4.6.0.6
wso2	wso2_carbon_api_management_implementation	>= 9.20.74 < 9.20.74.388	9.20.74.388
wso2	wso2_carbon_api_management_implementation	>= 9.28.116 < 9.28.116.395	9.28.116.395
wso2	wso2_carbon_api_management_implementation	>= 9.29.120 < 9.29.120.213	9.29.120.213
wso2	wso2_carbon_api_management_implementation	>= 9.30.67 < 9.30.67.135	9.30.67.135
wso2	wso2_carbon_api_management_implementation	>= 9.31.86 < 9.31.86.108	9.31.86.108
wso2	wso2_carbon_api_management_implementation	>= 9.32.147 < 9.32.147.5	9.32.147.5
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.20.74 < 9.20.74.388	9.20.74.388
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.28.116 < 9.28.116.395	9.28.116.395
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.29.120 < 9.29.120.213	9.29.120.213
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.30.67 < 9.30.67.135	9.30.67.135
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.31.86 < 9.31.86.108	9.31.86.108
wso2	wso2_carbon_api_manager_rest_api_utility	>= 9.32.147 < 9.32.147.5	9.32.147.5
wso2	wso2_traffic_manager	>= 4.5.0 < 4.5.0.40	4.5.0.40
wso2	wso2_traffic_manager	>= 4.6.0 < 4.6.0.6	4.6.0.6
wso2	wso2_universal_gateway	>= 4.5.0 < 4.5.0.40	4.5.0.40
wso2	wso2_universal_gateway	>= 4.6.0 < 4.6.0.6	4.6.0.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284