This vulnerability (CVE-2026-1728) in WSO2 API Manager involves improper privilege management (CWE-269) where tokens granted to low-privileged users can be used to invoke Admin REST APIs intended for higher privilege levels. Exploitation requires the attacker to have a valid low-privileged user account and token. The vulnerability impacts versions 4.0.0 through 4.6.0 inclusive. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An attacker with a low-privileged user account can leverage this vulnerability to access administrative REST APIs, potentially leading to full administrative account takeover. This compromises the confidentiality, integrity, and availability of the WSO2 API Manager environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to low-privileged user accounts and monitor for suspicious token usage where possible.