Introduction
Attackers can gain unauthenticated administrative access to enterprise systems when authentication and authorization controls on REST APIs fail. CVE-2025-10611 affects multiple WSO2 products and allows bypass of these critical controls, exposing organizations to the risk of unauthorized administrative operations and full system compromise.
WSO2 is a widely adopted provider of open source middleware for API management, identity and access management, and integration. Their products are used by large enterprises, governments, and financial institutions globally. Previous vulnerabilities in WSO2 products have led to rapid exploitation and significant security incidents.
Technical Information
CVE-2025-10611 results from insufficient access control implementation in multiple WSO2 products. Certain REST API endpoints do not properly enforce authentication and authorization. This allows attackers to invoke sensitive administrative API operations without presenting valid credentials or tokens.
The vulnerability is due to missing or flawed validation logic in the access control layer for REST APIs. Endpoints that should require authentication can be accessed directly. No public code snippets or exploit payloads are available. The root cause is a failure to consistently apply authentication and authorization checks on all administrative REST API endpoints.
Affected Systems and Versions
The official advisory states that "multiple WSO2 products" are affected. No specific product names, version numbers, or configuration details are provided in the available sources. Organizations should consult the official WSO2 advisory for updates on affected versions:
Vendor Security History
WSO2 has a history of critical vulnerabilities involving authentication and access control failures:
- CVE-2024-6914: SOAP admin authentication bypass, allowed unauthorized password resets for any user including administrators.
- CVE-2022-29464: Unauthenticated file upload and remote code execution, rapidly exploited in the wild.
The vendor typically publishes advisories and patches but has experienced recurring issues in access control implementations across product lines.