CVE-2026-1728

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in WSO2 Products via Admin REST API

Publication date: 2026-08-06

Last updated on: 2026-08-10

Assigner: WSO2 LLC

Description

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-10

Generated

2026-08-18

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-17

NVD

CVE-2026-1728

EUVD

EUVD-2026-53821

Affected Vendors & Products

Vendor	Product	Version / Range
wso2	api_control_plane	From 4.5.0 (inc) to 4.5.0.49 (exc)
wso2	api_control_plane	From 4.6.0 (inc) to 4.6.0.13 (exc)
wso2	api_manager	From 4.0.0 (inc) to 4.0.0.384 (exc)
wso2	api_manager	From 4.1.0 (inc) to 4.1.0.248 (exc)
wso2	api_manager	From 4.2.0 (inc) to 4.2.0.188 (exc)
wso2	api_manager	From 4.3.0 (inc) to 4.3.0.99 (exc)
wso2	api_manager	From 4.4.0 (inc) to 4.4.0.63 (exc)
wso2	api_manager	From 4.5.0 (inc) to 4.5.0.48 (exc)
wso2	api_manager	From 4.6.0 (inc) to 4.6.0.12 (exc)
wso2	traffic_manager	From 4.5.0 (inc) to 4.5.0.47 (exc)
wso2	traffic_manager	From 4.6.0 (inc) to 4.6.0.12 (exc)
wso2	universal_gateway	From 4.5.0 (inc) to 4.5.0.48 (exc)
wso2	universal_gateway	From 4.6.0 (inc) to 4.6.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-1728 is a privilege escalation vulnerability in WSO2 products where tokens issued to low-privileged users are not properly restricted. This allows these users to access Admin REST APIs, potentially leading to full administrative account takeover.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to Admin REST APIs by low-privileged users. Monitor logs for unusual API calls to admin endpoints, especially from non-admin accounts. Review token issuance and usage patterns for anomalies. Check if tokens issued to low-privileged users have elevated privileges or access to admin resources.

Impact Analysis

If exploited, this vulnerability enables a low-privileged user to gain full administrative access to WSO2 products. This could result in unauthorized control over systems, data breaches, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to administrative functions, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized access to personal or health data.

Mitigation Strategies

Apply the latest security patches provided by WSO2 for affected products. Restrict token privileges to ensure low-privileged users cannot access admin APIs. Review and revoke any suspicious tokens issued to low-privileged accounts. Monitor admin API access logs for unauthorized activity.

Hi! I’m here to help you understand CVE-2026-1728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70