The vulnerability arises from improper handling of identity during the silent JIT provisioning process in WSO2 API Manager. Specifically, when a federated user and a local user share the same username, the provisioning process does not segregate roles properly and overwrites the local user's roles with those assigned to the federated user. This can lead to unauthorized modification of local user roles. Exploitation requires a federated identity provider with silent JIT provisioning enabled and attacker knowledge of a local username. The impact is limited to role modification with roles defined by the federated IDP, which typically grants minimal access unless explicitly configured otherwise.

An attacker who controls or has access to a federated identity provider with silent JIT provisioning enabled and knows a local user's username can cause the local user's roles to be overwritten with roles from the federated IDP. This results in unauthorized modification of local user roles, potentially altering access permissions. The impact on confidentiality is none, but integrity and availability impacts are low due to role changes. The overwritten roles are limited to those defined by the federated IDP, which usually have minimal privileges unless configured otherwise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review their federated IDP configurations, especially the roles assigned during silent JIT provisioning, to minimize privilege escalation risks. Consider disabling silent JIT provisioning if feasible or implementing additional controls to segregate local and federated user roles. Monitor vendor advisories for updates or patches addressing this issue.