Introduction
When authentication and authorization controls on REST APIs fail, attackers can gain administrative access to enterprise systems without authenticating. CVE-2025-10611 is a bypass of those controls in multiple WSO2 products. It puts organizations at risk of unauthorized administrative operations and full system compromise.
WSO2 is a widely adopted provider of open source middleware for API management, identity and access management, and integration. Large enterprises, governments, and financial institutions around the world use its products. Earlier vulnerabilities in WSO2 products have been exploited rapidly and have led to significant security incidents.
Technical Information
CVE-2025-10611 comes from insufficient access control in multiple WSO2 products. Certain REST API endpoints do not properly enforce authentication and authorization, so attackers can invoke sensitive administrative API operations without presenting valid credentials or tokens.
The access control layer for REST APIs has missing or flawed validation logic, and endpoints that should require authentication can be accessed directly. The root cause is that authentication and authorization checks are not applied consistently to all administrative REST API endpoints. No public code snippets or exploit payloads are available.
Affected Systems and Versions
The official advisory states that "multiple WSO2 products" are affected. The available sources give no specific product names, version numbers, or configuration details. Organizations should check WSO2 Security Advisory WSO2-2025-4585 for updates on affected versions.
Vendor Security History
WSO2 products have had critical authentication and access control vulnerabilities before:
- CVE-2024-6914: a SOAP admin authentication bypass that allowed unauthorized password resets for any user, including administrators.
- CVE-2022-29464: unauthenticated file upload and remote code execution, rapidly exploited in the wild.
WSO2 typically publishes advisories and patches, but access control flaws have recurred across its product lines.
