CVE-2026-2613

EUVD-2026-115116
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.

A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
WSO2CNA
8.7 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wso2api_control_plane
4.5.0 ≤
𝑥
< 4.5.0.52
CNA
wso2api_control_plane
4.6.0 ≤
𝑥
< 4.6.0.16
CNA
wso2universal_gateway
4.5.0 ≤
𝑥
< 4.5.0.51
CNA
wso2universal_gateway
4.6.0 ≤
𝑥
< 4.6.0.15
CNA
Common Weakness Enumeration
References
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/