{"id":"CVE-2025-11969","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-11969","generatedAt":"2026-11-04T11:49:42.103Z","title":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted.","description":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.","published":"2026-11-02T06:17:42.000Z","lastModified":"2026-11-02T20:17:22.000Z","status":"Awaiting Analysis","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","cvss":{"version":"3.1","score":9.4,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"},"cwe":["CWE-285"],"affected":[],"epss":{"score":0.00323,"percentile":0.25442,"date":"2026-11-03","history":[{"date":"2026-11-03","score":0.00323,"percentile":0.25442}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-11-02T06:17:42.000Z","detail":{"score":"9.4","severity":"CRITICAL","publishedAt":"2026-11-02T06:17:42.087Z"},"summary":"New CVE, critical severity (CVSS 9.4)."}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-11969","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}