Medium · published May 11, 2026
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.
A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
| Product | Versions | Fixed in |
|---|---|---|
| wso2/api_control_plane | ≥ 4.5.0, < 4.5.0.18 | 4.5.0.18 |
| wso2/api_manager | ≥ 3.2.0, < 3.2.0.435 | 3.2.0.435 |
| wso2/api_manager | ≥ 3.2.1, < 3.2.1.55 | 3.2.1.55 |
| wso2/api_manager | ≥ 4.0.0, < 4.0.0.355 | 4.0.0.355 |
| wso2/api_manager | ≥ 4.1.0, < 4.1.0.219 | 4.1.0.219 |
| wso2/api_manager | ≥ 4.2.0, < 4.2.0.157 | 4.2.0.157 |
| wso2/api_manager | ≥ 4.3.0, < 4.3.0.70 | 4.3.0.70 |
| wso2/api_manager | ≥ 4.4.0, < 4.4.0.33 | 4.4.0.33 |
| wso2/api_manager | ≥ 4.5.0, < 4.5.0.17 | 4.5.0.17 |
| wso2/traffic_manager | ≥ 4.5.0, < 4.5.0.17 | 4.5.0.17 |
| wso2/universal_gateway | ≥ 4.5.0, < 4.5.0.17 | 4.5.0.17 |