CVE-2026-1728

published 2026-08-06

CVE-2026-1728: Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this…

Priority P3 55 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Affected

33 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.49	4.5.0.49
wso2	api_control_plane	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	api_manager	>= 4.0.0 < 4.0.0.384	4.0.0.384
wso2	api_manager	>= 4.1.0 < 4.1.0.248	4.1.0.248
wso2	api_manager	>= 4.2.0 < 4.2.0.188	4.2.0.188
wso2	api_manager	>= 4.3.0 < 4.3.0.99	4.3.0.99
wso2	api_manager	>= 4.4.0 < 4.4.0.63	4.4.0.63
wso2	api_manager	>= 4.5.0 < 4.5.0.48	4.5.0.48
wso2	api_manager	>= 4.6.0 < 4.6.0.12	4.6.0.12
wso2	traffic_manager	>= 4.5.0 < 4.5.0.47	4.5.0.47
wso2	traffic_manager	>= 4.6.0 < 4.6.0.12	4.6.0.12
wso2	universal_gateway	>= 4.5.0 < 4.5.0.48	4.5.0.48
wso2	universal_gateway	>= 4.6.0 < 4.6.0.12	4.6.0.12
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.49	4.5.0.49
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.13	4.6.0.13
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.384	4.0.0.384
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.248	4.1.0.248
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.188	4.2.0.188
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.99	4.3.0.99
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.63	4.4.0.63
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.48	4.5.0.48
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.12	4.6.0.12
wso2	wso2_carbon_api_manager_rest_api_common_functions	>= 9.0.174 < 9.0.174.550	9.0.174.550
wso2	wso2_carbon_api_manager_rest_api_common_functions	>= 9.28.116 < 9.28.116.404	9.28.116.404
wso2	wso2_carbon_api_manager_rest_api_common_functions	>= 9.29.120 < 9.29.120.221	9.29.120.221

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269