Threats tagged 'ghsa-78r2-rh3v-h2fx'

CVE-2025-14561 is a critical improper access control vulnerability in WSO2 API Manager affecting multi-tenant deployments. The Publisher REST APIs do not properly enforce tenant isolation, allowing a privileged user in one tenant to perform publisher operations such as exposing or modifying API metadata in other tenants. This issue impacts versions 4.1.0 through 4.6.0. The vulnerability has a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.