CVE-2026-1728

CRITICAL

CVE: CVE-2026-1728 - Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIsSign in to save

CVSS

9.8

CVSS v3.1

EPSS

0.3%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.3%

Description

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.

Weaknesses

CWE-269

Affected Packages

No package data available.

Aliases

CVE-2026-1728

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/