A privilege management flaw in WSO2 API Manager allows low-privileged users to access sensitive administrative APIs, posing a severe risk of full account takeover.

The vulnerability stems from insufficient restriction of tokens issued to low-privileged users, which are erroneously accepted by product-level Admin REST APIs. This allows an attacker who already possesses a standard user account to escalate privileges and invoke administrative functions.

The ability for a low-privileged user to access Admin REST APIs effectively grants an attacker administrative control over the WSO2 ecosystem. This can lead to the unauthorized configuration of gateways, manipulation of API traffic, and potential data exfiltration. The CVSS score of 9.8 underscores the critical nature of this privilege escalation.

Immediate Action: Update WSO2 products to the fixed versions (e.g., 9.33.27 or later for the affected Carbon API components) as detailed in the official WSO2 security advisory.

Proactive Monitoring: Audit API access logs for any anomalous requests made to administrative endpoints by users that do not possess the required administrative roles.

Compensating Controls: Implement strict network segmentation for administrative interfaces and ensure that API gateways are configured to enforce robust scope and role validation for all incoming requests.

Public Exploit Available: Unknown

The risk of privilege escalation to full administrative access necessitates an immediate review of all WSO2 deployments. Organizations must apply the vendor-provided patches promptly to close the authorization gaps and prevent unauthorized administrative access.