CRITICAL 9.0 NVD

CVE-2025-14561

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privile

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/W

Published: 2026-08-06 · Source: NVD · Feed updated: 2026-08-07

This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-08-06 via NVD.

Risk Timeline

CVE Disclosed2026-08-06 · 0 days ago

Remediation Resources

Official Advisory

security.docs.wso2.com/en/latest/security-announcements/security-advis

vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.