In multi-tenant deployments of WSO2 API Manager versions 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, and 4.6.0, the Publisher REST APIs do not correctly enforce tenant isolation. This improper access control (CWE-284) allows a user with sufficient privileges in one tenant to perform publisher operations that affect other tenants, including exposing or modifying API metadata. The vulnerability is critical with a CVSS 3.1 score of 9.0, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. No vendor advisory or patch information is currently provided.

A privileged user in one tenant can access and modify API metadata belonging to other tenants in a multi-tenant environment. This compromises tenant isolation, potentially exposing sensitive information and allowing unauthorized changes to APIs across tenants. The impact includes high confidentiality and integrity loss and limited availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileged access to trusted users only and consider isolating tenants through deployment architecture to minimize cross-tenant risks.