Privilege Escalation

org.wso2.am, am-parent, org.wso2.is, identity-server-parent are vulnerable to privilege escalation. The vulnerability is due to improper validation and access control in the SOAP admin services, which allows attackers to assign elevated privileges to self-registered users under specific deploymen...

Incorrect Authorization

WSO2 is vulnerable to Incorrect Authorization. The vulnerability is due to improper authorization checks due to the ability to access protected APIs using a refresh token instead of an access token, potentially allowing prolonged unauthorized access to API resources...