CVE-2026-4052

Summary

A misconfigured WSO2 Identity Server acting as a Resident Key Manager with database sharing allows self-registered users to obtain tokens that grant unauthorized access to WSO2 API Manager's System REST APIs due to missing authorization checks.

Exploitability

Exploitation requires the target environment to be explicitly configured with WSO2 Identity Server as a Resident Key Manager using database sharing and a self-registration flow; no public exploit exists yet.

Blast radius

Successful exploitation could lead to full compromise of API Manager system resources, including data exfiltration, unauthorized configuration changes, or service disruption.

Detection

Monitor for self-registered users (e.g., via /t/{tenant}/api/users/v1/me or self-registration logs) successfully calling System REST API endpoints (e.g., /api/am/publisher/v4/*, /api/am/admin/v4/*) with tokens issued by the Identity Server token endpoint; look for anomalous token usage patterns by newly registered users.

Prioritized remediation

Upgrade to WSO2 Identity Server version 7.3.0-M15 or later, where this authorization bypass has been fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.