CVE-2026-1728

🗓️ 06 Aug 2026 08:16:31Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 11 Views

Low-privileged tokens with a valid token can access admin REST APIs.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-1728	6 Aug 202607:33	–	attackerkb
Circl	CVE-2026-1728	6 Aug 202608:28	–	circl
CVE	CVE-2026-1728	6 Aug 202607:33	–	cve
Cvelist	CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover	6 Aug 202607:33	–	cvelist
EUVD	EUVD-2026-53821	6 Aug 202607:33	–	euvd
Vulnrichment	CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover	6 Aug 202607:33	–	vulnrichment

NVD

Node

OR

wso2 api_control_planeRange4.5.0–4.5.0.49

wso2 api_control_planeRange4.6.0–4.6.0.13

Node

OR

wso2 api_managerRange4.0.0–4.0.0.384

wso2 api_managerRange4.1.0–4.1.0.248

wso2 api_managerRange4.2.0–4.2.0.188

wso2 api_managerRange4.3.0–4.3.0.99

wso2 api_managerRange4.4.0–4.4.0.63

wso2 api_managerRange4.5.0–4.5.0.48

wso2 api_managerRange4.6.0–4.6.0.12

Node

OR

wso2 traffic_managerRange4.5.0–4.5.0.47

wso2 traffic_managerRange4.6.0–4.6.0.12

Node

OR

wso2 universal_gatewayRange4.5.0–4.5.0.48

wso2 universal_gatewayRange4.6.0–4.6.0.12

Source	Link
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/

10 Aug 2026 12:32Current

CVSS 3.19.8

EPSS0.00303

low privileged token admin rest api token based access full admin takeover valid token required wso2 products