The Ajax processor in WSO2's Carbon consoles processes state‑changing operations using the HTTP GET method. The same‑site cookie attribute is set to Lax, but this does not stop GET requests from being sent with cross‑origin top‑level navigation. A malicious site can therefore trick a logged‑in user’s browser into performing unintended actions. This results in unauthorized modifications such as data tampering, account changes, or loss of user control. The vulnerability is a classic CSRF flaw, identified as CWE‑352.

The flaw affects a broad set of WSO2 products, including the API Control Plane, API Manager, various Carbon consoles (Command Mediator UI, Event UI, Governance UI, Identity Management UI, etc.), Enterprise Integrator, Identity Server, Open Banking AM/IAM, Stratos components, Traffic Manager, Universal Gateway, and others. Version specifics are not provided in the CNA data, so verification of affected releases should be performed on each product by consulting the vendor’s advisory.

With a CVSS score of 5.4, the issue is considered a moderate risk. No EPSS score is reported, and the vulnerability is not listed in CISA’s KEV catalog. The attack is feasible only when the Carbon console or related services are exposed to the public internet, a configuration that WSO2 advises against. An attacker would need to host a malicious page that initiates a cross‑origin GET request, causing the victim’s browser to send the stored authentication cookie and trigger the state‑changing operation.