Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-4052— Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

此问题仅影响将 WSO2 Identity Server 配置为本地密钥管理器（Resident Key Manager）并启用数据库共享的部署环境。在此类环境中，自注册用户可通过从 WSO2 Identity Server 的令牌端点获取令牌，进而访问 WSO2 API Manager 的系统 REST API。

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-4052

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
Source: CVE Program / CVE List V5
Vulnerability Description
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 4.1.0 -
WSO2 WSO2 API Control Plane 4.5.0 -
WSO2 WSO2 Identity Server Key Manager Connector (apim-km-wso2is) 0 ~ 1.8.8 -

II. Public POCs for CVE-2026-4052

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-4052

请登录查看更多情报信息。

Other References for CVE-2026-4052 (1)

Same Patch Batch · WSO2 · 2026-11-03 · 3 CVEs total

CVE-2025-5769 6.1 MEDIUM Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allow
CVE-2025-1397 4.8 MEDIUM Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Prod

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-862