CVE-2026-4052 affects deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In these environments, a self-registered user can obtain a token from the WSO2 Identity Server token endpoint and use it to access the System REST APIs of WSO2 API Manager. This vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.