This vulnerability arises from the software assigning permissions instead of properly checking them for certain Gateway API invocations in WSO2 API Control Plane 4.5.0. Specifically, users with the 'Internal/Everyone' role can bypass intended role-based access controls and invoke sensitive Gateway and Internal Service APIs. This flaw enables authenticated users to perform operations that should be restricted, violating the principle of least privilege and potentially impacting confidentiality, integrity, and availability of the system.

An attacker with a valid user account on a vulnerable WSO2 API Control Plane deployment can bypass role-based access controls to invoke sensitive Gateway REST APIs. This can lead to unauthorized actions that may affect system behavior, data integrity, and availability. The CVSS score of 6.3 reflects a medium severity impact with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and the remediation level is unspecified, users should monitor WSO2 advisories for updates. Until a fix is available, restrict access to the API Control Plane to trusted users only and consider additional access control measures to limit exposure.