What is CVE-2025-11969?

CVE-2025-11969 is a critical-severity vulnerability in Wso2 API Control Plane, classified under Improper Authorization. CVSS score: 9.4/10. Published 2026-11-02.

How severe is CVE-2025-11969?

Critical severity. CVSS v3 base score is 9.4 out of 10.

Auth bypass in Wso2 API Control Plane

CVE-2025-11969

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.

Published 2026-11-02 · last modified 2026-11-02.

CVSS v3 metric

CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)

Frequently asked questions

What is CVE-2025-11969?: CVE-2025-11969 is a critical-severity vulnerability in Wso2 API Control Plane, classified under Improper Authorization. CVSS score: 9.4/10. Published 2026-11-02.
How severe is CVE-2025-11969?: Critical severity. CVSS v3 base score is 9.4 out of 10.