# CVE-2025-10611: Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

- Exploited (CISA KEV): no
- Published: 2025-10-16
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 0.8% (57th percentile)

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.

Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 48 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-12-03 · new · rule 200013143
  > Added: signature 200013143 "WSO2 API Manager Authentication Bypass" (Authentication/Authorization Attacks, risk High), systems: Java Servlets/JSP. References: CVE-2025-10611.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-10611 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-10611