Vulnerability in Wso2 Carbon Identity Api Server Secret Management Common
CVE-2025-14779
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associat…
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Wso2 Carbon Identity Api Server Secret Management Common — versions 1.2.3, 1.2.23, 1.3.83
- Wso2 Carbon Identity Api Server Secret Management V1 — versions 1.2.3, 1.2.23, 1.3.83
- Wso2 Identity Server — versions 6.0.0, 6.1.0, 7.1.0
Weakness classification (CWE)
References
- ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-14779?
- CVE-2025-14779 is a low-severity vulnerability in Wso2 Carbon Identity Api Server Secret Management Common, classified under Improper Preservation of Permissions. CVSS score: 3.8/10. Published 2026-08-06.
- How severe is CVE-2025-14779?
- Low severity. CVSS v3 base score is 3.8 out of 10.