CVE-2025-14561
EUVD-2025-21064706.08.2026, 22:16
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| wso2 | api_control_plane | 4.5.0 ≤ 𝑥 < 4.5.0.42 | CNA |
| wso2 | api_control_plane | 4.6.0 ≤ 𝑥 < 4.6.0.7 | CNA |
| wso2 | universal_gateway | 4.5.0 ≤ 𝑥 < 4.5.0.40 | CNA |
| wso2 | universal_gateway | 4.6.0 ≤ 𝑥 < 4.6.0.6 | CNA |
Common Weakness Enumeration