The vulnerability arises because the software fails to enforce role‑based access controls for selected Gateway API calls. Users assigned to the default 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks and allowing them to carry out sensitive operations that should be restricted. The impact is that an attacker with a valid account can execute privileged actions against the Gateway REST API and, in some cases, internal service APIs exposed in certain WSO2 APIM 3.x installations, potentially leading to misuse or unintended behavior, especially in production environments.

The affected products are the WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Management Implementation, WSO2 Carbon API Manager Rest API Utility, WSO2 Traffic Manager, and WSO2 Universal Gateway. Exact versions are not provided; however, the description indicates that WSO2 APIM 3.x releases are impacted.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of less than 1 % means the likelihood of exploitation in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote or local access to the Gateway REST API, because an authenticated user with any valid account can exploit the flaw. No additional hardening beyond the vendor’s patch is described in the advisory.