CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

What is CVE-2026-1728?

CVE-2026-1728 is a critical vulnerability in Wso2 Api Manager, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Weakness: CWE-269

Which versions are affected by CVE-2026-1728?

It affects 4 products.

Products include Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Traffic Manager, Wso2 Universal Gateway.

How do I fix CVE-2026-1728?

No fix has been published for CVE-2026-1728 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-1728 being exploited?

There is no known exploitation of CVE-2026-1728 in the wild and no public exploit code.

Other vulnerabilities in Wso2 Api Manager

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability Exploited Critical 10.0
• CVE-2025-9312 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products Critical 9.8
• CVE-2025-10611 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs Critical 9.8
• CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint Critical 9.8
• CVE-2025-9804 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs Critical 9.6

All Wso2 Api Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-88j3-cjwq-qqvv.