Description
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing.

This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.
Published: 2026-07-04
Score: 3.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In WSO2’s multi‑tenant products, the application consent mechanism incorrectly isolates consent scopes between tenants. When a user consents to a SaaS application in one tenant, that consent can be incorrectly applied to SaaS applications with the same name in other tenants, allowing unauthorized access to data across tenants. This results in cross‑violating user privacy. The weakness is defined by CWE‑288: Missing Authentication for Critical Function, indicating that process.

Affected Systems

The affected products are WSO2 API Manager and WSO2 Identity Server. The flaw applies to any multi‑tenant deployment of these products where application consent scopes are not tenant‑isolated; specific release versions are not listed in the information provided.

Risk and Exploitability

The CVSS score of 3.5 indicates a low severity. The EPSS score is less than 1%, implying it is not listed in CISA’s KEV catalog, suggesting no known active exploits. The likely attack involves a malicious actor deploying or registering a SaaS application in a tenant other than the one where the target user granted consent, then leveraging normal user consent flows to access data across tenants.

Generated by OpenCVE AI on July 24, 2026 at 10:01 UTC.

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-1613/#solution

OpenCVE Recommended Actions

  • Apply the official patch at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-1613/#solution
  • Verify tenant isolation settings for application consent are correctly configured so that consent scopes remain tenant‑specific
  • Avoid reusing identical application names across tenants; rename applications to prevent accidental consent sharing

Generated by OpenCVE AI on July 24, 2026 at 10:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Wso2
Wso2 wso2 Api Manager
Wso2 wso2 Identity Server
Vendors & Products Wso2
Wso2 wso2 Api Manager
Wso2 wso2 Identity Server

Sat, 04 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Description In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.
Title Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Wso2 Wso2 Api Manager Wso2 Identity Server
cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-07-06T13:55:26.159Z

Reserved: 2025-11-20T12:17:18.234Z

Link: CVE-2025-13475

cve-icon Vulnrichment

Updated: 2026-07-06T13:55:20.810Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:15:02Z

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel