The Secret Type Management REST API in WSO2 Identity Server versions 6.0.0, 6.1.0, and 7.1.0 improperly assigns permissions instead of checking them when deleting a secret type. Specifically, the on-delete cascade logic fails to enforce organizational boundaries, causing secrets associated with the deleted type to be removed across all organizations rather than being scoped to the requesting organization. This can lead to unintended deletion of secrets, potentially causing configuration failures, service interruptions, and denial-of-service conditions. The vulnerability requires high privileges (delete permissions) which are by default limited to administrators. There is no vendor advisory or patch information available at this time.

Exploitation can result in the unintended deletion of secrets across the entire WSO2 Identity Server deployment, affecting all organizations. This may cause configuration failures, service interruptions, and denial-of-service conditions. However, the impact is limited by the requirement that the attacker must have delete permissions on the Secret Type Management REST API, which are by default only granted to administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delete permissions on the Secret Type Management REST API to trusted administrators only to minimize risk. Monitor administrative access and audit secret deletions to detect potential misuse.