In multi-tenant deployments of WSO2 API Manager versions 4.1.0 through 4.6.0, the Publisher REST APIs fail to enforce tenant isolation correctly. This improper access control (CWE-284) allows a user with sufficient privileges in one tenant to perform publisher operations that affect other tenants, such as exposing or modifying API metadata. The vulnerability is critical with a CVSS 3.1 base score of 9.0, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

A privileged user within one tenant can access and modify API metadata belonging to other tenants in a multi-tenant deployment, potentially leading to unauthorized disclosure and modification of sensitive API information. This compromises tenant isolation and can affect the confidentiality and integrity of APIs across tenants, with a limited impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict privileged user access to trusted personnel only and monitor API management activities closely to detect any unauthorized cross-tenant operations.