{"id":"CVE-2026-1728","aliases":["EUVD-2026-53821","GHSA-88j3-cjwq-qqvv"],"status":"published","title":"Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover","description":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.\n\nExploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00483,"percentile":0.41888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-08-06T07:33:25Z","modified":"2026-08-10T12:32:08Z","products":[{"vendor":"wso2","product":"api_control_plane"},{"vendor":"wso2","product":"api_manager"},{"vendor":"wso2","product":"traffic_manager"},{"vendor":"wso2","product":"universal_gateway"},{"vendor":"wso2","product":"wso2 api control plane"},{"vendor":"wso2","product":"wso2 api manager"},{"vendor":"wso2","product":"wso2 carbon api manager rest api common functions"},{"vendor":"wso2","product":"wso2 carbon api manager rest api utility"},{"vendor":"wso2","product":"wso2 traffic manager"},{"vendor":"wso2","product":"wso2 universal gateway"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1728"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077"},{"url":"https://github.com/advisories/GHSA-88j3-cjwq-qqvv"}],"sources":{"cve":[{"id":"CVE-2026-1728","title":"Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover","description":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.\n\nExploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.","status":"published","published":"2026-08-06T07:33:25.717Z","modified":"2026-08-06T12:31:19.553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-53821","description":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.\n\nExploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.","status":"published","published":"2026-08-06T07:33:25Z","modified":"2026-08-06T12:31:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-88j3-cjwq-qqvv","title":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used...","description":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.\n\nExploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.","status":"published","published":"2026-08-06T09:30:32Z","modified":"2026-08-06T09:30:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:10:09.171432Z"}],"nvd":[{"id":"CVE-2026-1728","description":"Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.\n\nExploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.","status":"published","published":"2026-08-06T08:16:31.423Z","modified":"2026-08-10T12:32:08.36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}