Critical Vulnerability in WSO2 API Manager and Identity Server: CVE-2026-4052

Executive Summary

A critical vulnerability, CVE-2026-4052, with a CVSS score of 9.8, has been identified in WSO2 API Manager and Identity Server. This vulnerability allows self-registered users to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint. This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing.

Technical Analysis

The vulnerability class of CVE-2026-4052 is related to improper access control. An attacker would need to be able to self-register on the WSO2 Identity Server and then use the token endpoint to gain access to the System REST APIs of WSO2 API Manager. The root cause of this vulnerability is the lack of proper validation and authorization checks in the affected configurations.

How It Gets Exploited

An attacker starts by self-registering on the WSO2 Identity Server. With self-registration, the attacker obtains credentials. The attacker then uses these credentials to obtain a token from the WSO2 Identity Server token endpoint. With this token, the attacker can gain unauthorized access to the System REST APIs of WSO2 API Manager. This access could allow the attacker to perform various actions, potentially leading to data exposure, system compromise, or disruption of service.

Impact Assessment

The affected products and versions are: - WSO2 API Manager: versions 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0 - WSO2 API Control Plane: versions 4.5.0, 4.6.0 - WSO2 Identity Server Key Manager Connector: versions less than 1.8.8 The impact of this vulnerability is severe, with potential for high confidentiality, integrity, and availability impacts. The CVSS score of 9.8 reflects the critical nature of this vulnerability.

Recommended Actions

To mitigate this vulnerability, the following actions are recommended: - Update WSO2 API Manager to version 4.6.1 or later. - Update WSO2 API Control Plane to version 4.6.1 or later. - Update WSO2 Identity Server Key Manager Connector to version 1.8.8 or later. - If immediate patching is not feasible, consider disabling self-registration on the WSO2 Identity Server or restricting access to the System REST APIs of WSO2 API Manager. - Monitor for any suspicious activity related to self-registration and token issuance.

Sources

- National Vulnerability Database (NVD): CVE-2026-4052 - WSO2 Security Advisory: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/