CVEvulnerability

CVE-2025-12317

5.0 MEDIUM Published 2026-08-06 Modified 2026-09-29 Official page ↗

Status: Deferred
Published: 2026-08-06
Last modified: 2026-09-29
Assigner: ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8): 5.0 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses: CWE-613

Description

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

Weakness · not in database (1)

CWE-613

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4672/ security.docs.wso2.com

CVE-2025-12317

Description

Related

Weakness · not in database (1)

References