Review reviewHigh

CVE-2025-13475

WSO2 WSO2 Identity Server, WSO2 API Manager, api manager

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy vi...

CVSS: 7.3
EPSS: 0.16%
CISA KEV: Not listed
Published: 2026.07.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.16%

Technical severityCVSS 7.3

Vulnerability overview

Affected product and versions

Product: WSO2 WSO2 Identity Server, WSO2 API Manager, api manager
Affected versions: 5.10.0, 3.2.0, 3.2.1, >= 3.2.0 < 3.2.0.457, >= 3.2.1 < 3.2.1.76, >= 5.10.0 < 5.10.0.382
Fixed versions: 3.2.0.457, 3.2.1.76, 5.10.0.382

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that WSO2 WSO2 Identity Server, WSO2 API Manager, api manager and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE: CWE-288