Publisher REST API Tenant Isolation Bypass

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WSO2 LLC

Description

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2025-14561

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper enforcement of tenant isolation in multi-tenant deployments. A privileged user in one tenant can misuse Publisher REST APIs to perform actions like exposing or modifying API metadata in another tenant's environment.

Impact Analysis

If you are a tenant in a multi-tenant system, a malicious user with sufficient privileges in another tenant could access or alter your API metadata, potentially leading to data exposure or service disruption.

Mitigation Strategies

Immediately review and enforce strict tenant isolation in multi-tenant deployments. Ensure API access controls are properly configured to prevent unauthorized cross-tenant operations. Audit all privileged user permissions and restrict access to Publisher REST APIs to only necessary users.

Hi! I’m here to help you understand CVE-2025-14561. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70