{"id":"CVE-2026-4052","published":"2026-11-03T08:17:15.530","lastModified":"2026-11-03T08:17:15.530","description":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A misconfigured WSO2 Identity Server acting as a Resident Key Manager with database sharing allows self-registered users to obtain tokens that grant unauthorized access to WSO2 API Manager's System REST APIs due to missing authorization checks.","exploitability":"Exploitation requires the target environment to be explicitly configured with WSO2 Identity Server as a Resident Key Manager using database sharing and a self-registration flow; no public exploit exists yet.","blast_radius":"Successful exploitation could lead to full compromise of API Manager system resources, including data exfiltration, unauthorized configuration changes, or service disruption.","remediation":"Upgrade to WSO2 Identity Server version 7.3.0-M15 or later, where this authorization bypass has been fixed.","detection":"Monitor for self-registered users (e.g., via /t/{tenant}/api/users/v1/me or self-registration logs) successfully calling System REST API endpoints (e.g., /api/am/publisher/v4/*, /api/am/admin/v4/*) with tokens issued by the Identity Server token endpoint; look for anomalous token usage patterns by newly registered users.","tags":["auth-bypass","misconfiguration","identity-server","api-manager","database-sharing"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:55:29.134Z"}}