Affects widely used enterprise WSO2 management System REST APIs, allows low-privilege users to perform admin actions; CVSS 9.4 — enterprise-impacting and newsworthy.
CVE-2025-11969
Privilege escalation in WSO2 System REST APIs allowing low-privilege users to perform admin actions.
Is CVE-2025-11969 being exploited?
Not confirmed. CVE-2025-11969 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2025-11969?
CVE-2025-11969 is rated Critical with a CVSS score of 9.4. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2025-11969?
Yes. A fix has been recorded for CVE-2025-11969. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2025-11969 affect?
CVE-2025-11969 affects WSO2 System REST APIs, WSO2 management/admin interfaces. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2025-11969?
Apply vendor patch immediately; restrict access to management APIs and audit admin logs.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Low-privilege users can execute unauthorized administrative operations via System REST APIs, enabling remote privilege escalation and control.
Immediate action required
- affected< 4.5.0
- affected>= 4.5.0 and < 4.5.0.33
- affected< 3.1.0
- affected>= 3.1.0 and < 3.1.0.347
- affected>= 3.2.0 and < 3.2.0.450
- affected>= 3.2.1 and < 3.2.1.70
- affected>= 4.0.0 and < 4.0.0.370
- affected>= 4.1.0 and < 4.1.0.233
- affected>= 4.2.0 and < 4.2.0.173
- affected>= 4.3.0 and < 4.3.0.85
- affected>= 4.4.0 and < 4.4.0.49
- affected>= 4.5.0 and < 4.5.0.32
- affected>= 9.0.174 and < 9.0.174.538
- affected>= 9.20.74 and < 9.20.74.385
- affected>= 9.28.116 and < 9.28.116.382
- affected>= 9.29.120 and < 9.29.120.204
- affected>= 9.30.67 and < 9.30.67.126
- affected>= 9.31.86 and < 9.31.86.91
- affected>= 6.6.163 and < 6.6.163.159
- affected>= 6.6.163 and < 6.6.163.160
- affected>= 6.7.206 and < 6.7.206.574
- affected>= 6.7.206 and < 6.7.206.576
- affected>= 6.7.210 and < 6.7.210.69
- affected>= 6.7.210 and < 6.7.210.71
- affected>= 9.0.174 and < 9.0.174.536
- affected>= 9.20.74 and < 9.20.74.384
- affected>= 9.20.74 and < 9.20.74.385
- affected>= 9.28.116 and < 9.28.116.380
- affected>= 9.29.120 and < 9.29.120.202
- affected>= 9.30.67 and < 9.30.67.125
- affected>= 9.31.86 and < 9.31.86.90
- affected< 5.10.0
- affected>= 5.10.0 and < 5.10.0.367
- affected< 2.0.0
- affected>= 2.0.0 and < 2.0.0.396
- affected< 2.0.0
- affected>= 2.0.0 and < 2.0.0.416
- affected< 4.5.0
- affected>= 4.5.0 and < 4.5.0.31
- affected< 4.5.0
- affected>= 4.5.0 and < 4.5.0.31
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.