This vulnerability in WSO2 API Manager arises from insufficient restriction on tokens issued to low-privileged users, enabling them to invoke Admin REST APIs intended for higher privilege levels. The flaw is classified as CWE-269 (Improper Privilege Management). Successful exploitation can lead to full administrative account takeover. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 4.0.0 through 4.6.0. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with a low-privileged user account and a valid token can access administrative REST APIs, potentially leading to full administrative account takeover. This compromises confidentiality, integrity, and availability of the WSO2 API Manager environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to low-privileged user accounts and monitor for suspicious token usage. Avoid exposing administrative APIs to untrusted networks.