CVE-2025-10611
Published: 16 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-10611 is a critical vulnerability (CVSS score 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) published on 2025-10-16, associated with CWE-863 (Incorrect Authorization). It stems from an insufficient access control implementation in multiple WSO2 products, enabling attackers to bypass authentication and authorization checks for certain REST APIs and invoke them without proper validation.
The vulnerability can be exploited remotely by unauthenticated attackers requiring no privileges, low attack complexity, and no user interaction. Successful exploitation allows a malicious actor to gain administrative access and perform unauthenticated and unauthorized administrative operations.
Mitigation details are available in the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows unauthenticated remote attackers to bypass authorization on public-facing REST APIs in WSO2 products, directly enabling exploitation of a public-facing application to gain administrative access.