A Cross-Site Request Forgery vulnerability in multiple WSO2 products could allow an attacker to perform unauthorized administrative actions by tricking an authenticated user into visiting a malicious link.

This is a Cross-Site Request Forgery (CWE-352) flaw where state-changing operations in the Carbon console event processor utilize the HTTP GET method. Because the application improperly relies on SameSite=Lax cookie attributes, an attacker can force an authenticated administrator to execute unintended, unauthorized administrative commands.

Successful exploitation permits an attacker to perform unauthorized administrative operations, potentially leading to full service disruption, data modification, or account configuration changes. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity, as it bypasses intended access controls through user-assisted interaction.

Immediate Action: Apply the vendor-provided security updates immediately by following the official WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4117/.

Proactive Monitoring: Review access logs for the Carbon console for anomalous GET requests originating from unexpected sources or unusual patterns of administrative activity.

Compensating Controls: Ensure the Carbon console is not exposed to untrusted networks, and implement strict network segmentation to limit the reach of potential CSRF attacks.

Public Exploit Available: exploit_available (unknown)

Given the high severity score and the potential for unauthorized administrative manipulation, organizations utilizing the affected WSO2 products must prioritize applying the vendor patches. Administrators should verify their current version against the specific ranges provided in the vendor advisory and perform the necessary updates to ensure the Carbon console is protected against these forged requests.