CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-1728

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 21.9%

CVSS Severity

CVSS v3 Score 9.8

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/

Products affected by CVE-2026-1728

Wso2 » Api Control Plane » Version: 4.5.0

cpe:2.3:a:wso2:api_control_plane:4.5.0
Wso2 » Api Control Plane » Version: 4.5.0.18

cpe:2.3:a:wso2:api_control_plane:4.5.0.18
Wso2 » Api Control Plane » Version: 4.5.0.21

cpe:2.3:a:wso2:api_control_plane:4.5.0.21
Wso2 » Api Control Plane » Version: 4.5.0.29

cpe:2.3:a:wso2:api_control_plane:4.5.0.29
Wso2 » Api Control Plane » Version: 4.5.0.44

cpe:2.3:a:wso2:api_control_plane:4.5.0.44
Wso2 » Api Control Plane » Version: 4.6.0

cpe:2.3:a:wso2:api_control_plane:4.6.0
Wso2 » Api Control Plane » Version: 4.6.0.8

cpe:2.3:a:wso2:api_control_plane:4.6.0.8
Wso2 » Api Manager » Version: 4.0.0

cpe:2.3:a:wso2:api_manager:4.0.0
Wso2 » Api Manager » Version: 4.0.0.168

cpe:2.3:a:wso2:api_manager:4.0.0.168
Wso2 » Api Manager » Version: 4.0.0.217

cpe:2.3:a:wso2:api_manager:4.0.0.217
Wso2 » Api Manager » Version: 4.0.0.269

cpe:2.3:a:wso2:api_manager:4.0.0.269
Wso2 » Api Manager » Version: 4.0.0.280

cpe:2.3:a:wso2:api_manager:4.0.0.280
Wso2 » Api Manager » Version: 4.0.0.293

cpe:2.3:a:wso2:api_manager:4.0.0.293
Wso2 » Api Manager » Version: 4.0.0.305

cpe:2.3:a:wso2:api_manager:4.0.0.305
Wso2 » Api Manager » Version: 4.0.0.310

cpe:2.3:a:wso2:api_manager:4.0.0.310
Wso2 » Api Manager » Version: 4.0.0.318

cpe:2.3:a:wso2:api_manager:4.0.0.318
Wso2 » Api Manager » Version: 4.0.0.319

cpe:2.3:a:wso2:api_manager:4.0.0.319
Wso2 » Api Manager » Version: 4.0.0.355

cpe:2.3:a:wso2:api_manager:4.0.0.355
Wso2 » Api Manager » Version: 4.0.0.368

cpe:2.3:a:wso2:api_manager:4.0.0.368
Wso2 » Api Manager » Version: 4.0.0.370

cpe:2.3:a:wso2:api_manager:4.0.0.370
Wso2 » Api Manager » Version: 4.0.0.373

cpe:2.3:a:wso2:api_manager:4.0.0.373
Wso2 » Api Manager » Version: 4.0.0.375

cpe:2.3:a:wso2:api_manager:4.0.0.375
Wso2 » Api Manager » Version: 4.0.0.380

cpe:2.3:a:wso2:api_manager:4.0.0.380
Wso2 » Api Manager » Version: 4.0.0.381

cpe:2.3:a:wso2:api_manager:4.0.0.381
Wso2 » Api Manager » Version: 4.1.0

cpe:2.3:a:wso2:api_manager:4.1.0
Wso2 » Api Manager » Version: 4.1.0.136

cpe:2.3:a:wso2:api_manager:4.1.0.136
Wso2 » Api Manager » Version: 4.1.0.152

cpe:2.3:a:wso2:api_manager:4.1.0.152
Wso2 » Api Manager » Version: 4.1.0.166

cpe:2.3:a:wso2:api_manager:4.1.0.166
Wso2 » Api Manager » Version: 4.1.0.169

cpe:2.3:a:wso2:api_manager:4.1.0.169
Wso2 » Api Manager » Version: 4.1.0.171

cpe:2.3:a:wso2:api_manager:4.1.0.171
Wso2 » Api Manager » Version: 4.1.0.187

cpe:2.3:a:wso2:api_manager:4.1.0.187
Wso2 » Api Manager » Version: 4.1.0.200

cpe:2.3:a:wso2:api_manager:4.1.0.200
Wso2 » Api Manager » Version: 4.1.0.206

cpe:2.3:a:wso2:api_manager:4.1.0.206
Wso2 » Api Manager » Version: 4.1.0.215

cpe:2.3:a:wso2:api_manager:4.1.0.215
Wso2 » Api Manager » Version: 4.1.0.216

cpe:2.3:a:wso2:api_manager:4.1.0.216
Wso2 » Api Manager » Version: 4.1.0.218

cpe:2.3:a:wso2:api_manager:4.1.0.218
Wso2 » Api Manager » Version: 4.1.0.219

cpe:2.3:a:wso2:api_manager:4.1.0.219
Wso2 » Api Manager » Version: 4.1.0.228

cpe:2.3:a:wso2:api_manager:4.1.0.228
Wso2 » Api Manager » Version: 4.1.0.231

cpe:2.3:a:wso2:api_manager:4.1.0.231
Wso2 » Api Manager » Version: 4.1.0.233

cpe:2.3:a:wso2:api_manager:4.1.0.233
Wso2 » Api Manager » Version: 4.1.0.236

cpe:2.3:a:wso2:api_manager:4.1.0.236
Wso2 » Api Manager » Version: 4.1.0.238

cpe:2.3:a:wso2:api_manager:4.1.0.238
Wso2 » Api Manager » Version: 4.1.0.242

cpe:2.3:a:wso2:api_manager:4.1.0.242
Wso2 » Api Manager » Version: 4.1.0.243

cpe:2.3:a:wso2:api_manager:4.1.0.243
Wso2 » Api Manager » Version: 4.1.0.244

cpe:2.3:a:wso2:api_manager:4.1.0.244
Wso2 » Api Manager » Version: 4.2.0

cpe:2.3:a:wso2:api_manager:4.2.0
Wso2 » Api Manager » Version: 4.2.0.100

cpe:2.3:a:wso2:api_manager:4.2.0.100
Wso2 » Api Manager » Version: 4.2.0.108

cpe:2.3:a:wso2:api_manager:4.2.0.108
Wso2 » Api Manager » Version: 4.2.0.127

cpe:2.3:a:wso2:api_manager:4.2.0.127
Wso2 » Api Manager » Version: 4.2.0.138

cpe:2.3:a:wso2:api_manager:4.2.0.138
Wso2 » Api Manager » Version: 4.2.0.144

cpe:2.3:a:wso2:api_manager:4.2.0.144
Wso2 » Api Manager » Version: 4.2.0.150

cpe:2.3:a:wso2:api_manager:4.2.0.150
Wso2 » Api Manager » Version: 4.2.0.153

cpe:2.3:a:wso2:api_manager:4.2.0.153
Wso2 » Api Manager » Version: 4.2.0.156

cpe:2.3:a:wso2:api_manager:4.2.0.156
Wso2 » Api Manager » Version: 4.2.0.157

cpe:2.3:a:wso2:api_manager:4.2.0.157
Wso2 » Api Manager » Version: 4.2.0.164

cpe:2.3:a:wso2:api_manager:4.2.0.164
Wso2 » Api Manager » Version: 4.2.0.169

cpe:2.3:a:wso2:api_manager:4.2.0.169
Wso2 » Api Manager » Version: 4.2.0.171

cpe:2.3:a:wso2:api_manager:4.2.0.171
Wso2 » Api Manager » Version: 4.2.0.173

cpe:2.3:a:wso2:api_manager:4.2.0.173
Wso2 » Api Manager » Version: 4.2.0.176

cpe:2.3:a:wso2:api_manager:4.2.0.176
Wso2 » Api Manager » Version: 4.2.0.178

cpe:2.3:a:wso2:api_manager:4.2.0.178
Wso2 » Api Manager » Version: 4.2.0.179

cpe:2.3:a:wso2:api_manager:4.2.0.179
Wso2 » Api Manager » Version: 4.2.0.182

cpe:2.3:a:wso2:api_manager:4.2.0.182
Wso2 » Api Manager » Version: 4.2.0.183

cpe:2.3:a:wso2:api_manager:4.2.0.183
Wso2 » Api Manager » Version: 4.2.0.184

cpe:2.3:a:wso2:api_manager:4.2.0.184
Wso2 » Api Manager » Version: 4.2.0.80

cpe:2.3:a:wso2:api_manager:4.2.0.80
Wso2 » Api Manager » Version: 4.3.0

cpe:2.3:a:wso2:api_manager:4.3.0
Wso2 » Api Manager » Version: 4.3.0.16

cpe:2.3:a:wso2:api_manager:4.3.0.16
Wso2 » Api Manager » Version: 4.3.0.39

cpe:2.3:a:wso2:api_manager:4.3.0.39
Wso2 » Api Manager » Version: 4.3.0.51

cpe:2.3:a:wso2:api_manager:4.3.0.51
Wso2 » Api Manager » Version: 4.3.0.55

cpe:2.3:a:wso2:api_manager:4.3.0.55
Wso2 » Api Manager » Version: 4.3.0.57

cpe:2.3:a:wso2:api_manager:4.3.0.57
Wso2 » Api Manager » Version: 4.3.0.65

cpe:2.3:a:wso2:api_manager:4.3.0.65
Wso2 » Api Manager » Version: 4.3.0.66

cpe:2.3:a:wso2:api_manager:4.3.0.66
Wso2 » Api Manager » Version: 4.3.0.67

cpe:2.3:a:wso2:api_manager:4.3.0.67
Wso2 » Api Manager » Version: 4.3.0.70

cpe:2.3:a:wso2:api_manager:4.3.0.70
Wso2 » Api Manager » Version: 4.3.0.74

cpe:2.3:a:wso2:api_manager:4.3.0.74
Wso2 » Api Manager » Version: 4.3.0.81

cpe:2.3:a:wso2:api_manager:4.3.0.81
Wso2 » Api Manager » Version: 4.3.0.83

cpe:2.3:a:wso2:api_manager:4.3.0.83
Wso2 » Api Manager » Version: 4.3.0.85

cpe:2.3:a:wso2:api_manager:4.3.0.85
Wso2 » Api Manager » Version: 4.3.0.88

cpe:2.3:a:wso2:api_manager:4.3.0.88
Wso2 » Api Manager » Version: 4.3.0.90

cpe:2.3:a:wso2:api_manager:4.3.0.90
Wso2 » Api Manager » Version: 4.3.0.91

cpe:2.3:a:wso2:api_manager:4.3.0.91
Wso2 » Api Manager » Version: 4.3.0.93

cpe:2.3:a:wso2:api_manager:4.3.0.93
Wso2 » Api Manager » Version: 4.3.0.94

cpe:2.3:a:wso2:api_manager:4.3.0.94
Wso2 » Api Manager » Version: 4.3.0.95

cpe:2.3:a:wso2:api_manager:4.3.0.95
Wso2 » Api Manager » Version: 4.4.0

cpe:2.3:a:wso2:api_manager:4.4.0
Wso2 » Api Manager » Version: 4.4.0.28

cpe:2.3:a:wso2:api_manager:4.4.0.28
Wso2 » Api Manager » Version: 4.4.0.29

cpe:2.3:a:wso2:api_manager:4.4.0.29
Wso2 » Api Manager » Version: 4.4.0.30

cpe:2.3:a:wso2:api_manager:4.4.0.30
Wso2 » Api Manager » Version: 4.4.0.33

cpe:2.3:a:wso2:api_manager:4.4.0.33
Wso2 » Api Manager » Version: 4.4.0.38

cpe:2.3:a:wso2:api_manager:4.4.0.38
Wso2 » Api Manager » Version: 4.4.0.45

cpe:2.3:a:wso2:api_manager:4.4.0.45
Wso2 » Api Manager » Version: 4.4.0.47

cpe:2.3:a:wso2:api_manager:4.4.0.47
Wso2 » Api Manager » Version: 4.4.0.49

cpe:2.3:a:wso2:api_manager:4.4.0.49
Wso2 » Api Manager » Version: 4.4.0.52

cpe:2.3:a:wso2:api_manager:4.4.0.52
Wso2 » Api Manager » Version: 4.4.0.54

cpe:2.3:a:wso2:api_manager:4.4.0.54
Wso2 » Api Manager » Version: 4.4.0.55

cpe:2.3:a:wso2:api_manager:4.4.0.55
Wso2 » Api Manager » Version: 4.4.0.57

cpe:2.3:a:wso2:api_manager:4.4.0.57
Wso2 » Api Manager » Version: 4.4.0.58

cpe:2.3:a:wso2:api_manager:4.4.0.58
Wso2 » Api Manager » Version: 4.4.0.59

cpe:2.3:a:wso2:api_manager:4.4.0.59
Wso2 » Api Manager » Version: 4.5.0

cpe:2.3:a:wso2:api_manager:4.5.0
Wso2 » Api Manager » Version: 4.5.0.11

cpe:2.3:a:wso2:api_manager:4.5.0.11
Wso2 » Api Manager » Version: 4.5.0.12

cpe:2.3:a:wso2:api_manager:4.5.0.12
Wso2 » Api Manager » Version: 4.5.0.14

cpe:2.3:a:wso2:api_manager:4.5.0.14
Wso2 » Api Manager » Version: 4.5.0.17

cpe:2.3:a:wso2:api_manager:4.5.0.17
Wso2 » Api Manager » Version: 4.5.0.20

cpe:2.3:a:wso2:api_manager:4.5.0.20
Wso2 » Api Manager » Version: 4.5.0.28

cpe:2.3:a:wso2:api_manager:4.5.0.28
Wso2 » Api Manager » Version: 4.5.0.30

cpe:2.3:a:wso2:api_manager:4.5.0.30
Wso2 » Api Manager » Version: 4.5.0.32

cpe:2.3:a:wso2:api_manager:4.5.0.32
Wso2 » Api Manager » Version: 4.5.0.35

cpe:2.3:a:wso2:api_manager:4.5.0.35
Wso2 » Api Manager » Version: 4.5.0.37

cpe:2.3:a:wso2:api_manager:4.5.0.37
Wso2 » Api Manager » Version: 4.5.0.38

cpe:2.3:a:wso2:api_manager:4.5.0.38
Wso2 » Api Manager » Version: 4.5.0.41

cpe:2.3:a:wso2:api_manager:4.5.0.41
Wso2 » Api Manager » Version: 4.5.0.43

cpe:2.3:a:wso2:api_manager:4.5.0.43
Wso2 » Api Manager » Version: 4.5.0.44

cpe:2.3:a:wso2:api_manager:4.5.0.44
Wso2 » Api Manager » Version: 4.5.0.9

cpe:2.3:a:wso2:api_manager:4.5.0.9
Wso2 » Api Manager » Version: 4.6.0

cpe:2.3:a:wso2:api_manager:4.6.0
Wso2 » Api Manager » Version: 4.6.0.1

cpe:2.3:a:wso2:api_manager:4.6.0.1
Wso2 » Api Manager » Version: 4.6.0.2

cpe:2.3:a:wso2:api_manager:4.6.0.2
Wso2 » Api Manager » Version: 4.6.0.3

cpe:2.3:a:wso2:api_manager:4.6.0.3
Wso2 » Api Manager » Version: 4.6.0.6

cpe:2.3:a:wso2:api_manager:4.6.0.6
Wso2 » Api Manager » Version: 4.6.0.7

cpe:2.3:a:wso2:api_manager:4.6.0.7
Wso2 » Api Manager » Version: 4.6.0.8

cpe:2.3:a:wso2:api_manager:4.6.0.8
Wso2 » Traffic Manager » Version: 4.5.0

cpe:2.3:a:wso2:traffic_manager:4.5.0
Wso2 » Traffic Manager » Version: 4.5.0.17

cpe:2.3:a:wso2:traffic_manager:4.5.0.17
Wso2 » Traffic Manager » Version: 4.5.0.19

cpe:2.3:a:wso2:traffic_manager:4.5.0.19
Wso2 » Traffic Manager » Version: 4.5.0.27

cpe:2.3:a:wso2:traffic_manager:4.5.0.27
Wso2 » Traffic Manager » Version: 4.5.0.42

cpe:2.3:a:wso2:traffic_manager:4.5.0.42
Wso2 » Traffic Manager » Version: 4.6.0

cpe:2.3:a:wso2:traffic_manager:4.6.0
Wso2 » Traffic Manager » Version: 4.6.0.7

cpe:2.3:a:wso2:traffic_manager:4.6.0.7
Wso2 » Universal Gateway » Version: 4.5.0

cpe:2.3:a:wso2:universal_gateway:4.5.0
Wso2 » Universal Gateway » Version: 4.5.0.17

cpe:2.3:a:wso2:universal_gateway:4.5.0.17
Wso2 » Universal Gateway » Version: 4.5.0.19

cpe:2.3:a:wso2:universal_gateway:4.5.0.19
Wso2 » Universal Gateway » Version: 4.5.0.27

cpe:2.3:a:wso2:universal_gateway:4.5.0.27
Wso2 » Universal Gateway » Version: 4.5.0.42

cpe:2.3:a:wso2:universal_gateway:4.5.0.42
Wso2 » Universal Gateway » Version: 4.6.0

cpe:2.3:a:wso2:universal_gateway:4.6.0
Wso2 » Universal Gateway » Version: 4.6.0.7

cpe:2.3:a:wso2:universal_gateway:4.6.0.7

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-1728

Products

Pricing

Contact Us