The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.

An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.381
5.11.0 affected < 5.11.0.428
6.0.0 affected < 6.0.0.255
6.1.0 affected < 6.1.0.256
7.0.0 affected < 7.0.0.133
7.1.0 affected < 7.1.0.41
7.2.0 affected < 7.2.0.3
WSO2 WSO2 API Manager unaffected
Version Status Constraints
0 unknown < 3.1.0
3.1.0 affected < 3.1.0.352
3.2.0 affected < 3.2.0.456
3.2.1 affected < 3.2.1.75
4.0.0 affected < 4.0.0.376
4.1.0 affected < 4.1.0.239
4.2.0 affected < 4.2.0.179
4.3.0 affected < 4.3.0.91
4.4.0 affected < 4.4.0.55
4.5.0 affected < 4.5.0.38
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Open Banking IAM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.421
WSO2 WSO2 Open Banking AM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.401
WSO2 WSO2 Identity Server as Key Manager unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.372
WSO2 WSO2 API Control Plane unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.39
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Universal Gateway unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.37
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Traffic Manager unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.37
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Enterprise Integrator unaffected
Version Status Constraints
0 unknown < 6.6.0
6.6.0 affected < 6.6.0.227
WSO2 WSO2 Carbon Identity Entitlement UI unknown
Version Status Constraints
5.17.5 affected < 5.17.5.331
5.18.187 affected < 5.18.187.329
5.23.8 affected < 5.23.8.210
5.25.92 affected < 5.25.92.166
7.0.78 affected < 7.0.78.157
x unaffected ≤ *
WSO2 WSO2 Carbon Identity Management UI1 unknown
Version Status Constraints
5.17.5 affected < 5.17.5.330
5.17.5 affected < 5.17.5.331
5.17.118 affected < 5.17.118.22
5.18.187 affected < 5.18.187.328
5.18.187 affected < 5.18.187.329
5.18.248 affected < 5.18.248.31
5.23.8 affected < 5.23.8.210
5.24.8 affected < 5.24.8.26
5.25.92 affected < 5.25.92.166
5.25.705 affected < 5.25.705.21
5.25.713 affected < 5.25.713.10
5.25.724 affected < 5.25.724.5
5.25.736 affected < 5.25.736.1
7.0.78 affected < 7.0.78.157
7.8.23 affected < 7.8.23.67
7.8.586 affected < 7.8.586.7
x unaffected ≤ *
WSO2 WSO2 Carbon Identity User Store Configuration UI unknown
Version Status Constraints
5.14.127 affected < 5.14.127.13
5.17.5 affected < 5.17.5.330
5.17.5 affected < 5.17.5.331
5.17.118 affected < 5.17.118.22
5.18.187 affected < 5.18.187.328
5.18.187 affected < 5.18.187.329
5.18.248 affected < 5.18.248.31
5.23.8 affected < 5.23.8.210
5.24.8 affected < 5.24.8.26
5.25.92 affected < 5.25.92.166
5.25.705 affected < 5.25.705.21
5.25.713 affected < 5.25.713.10
5.25.724 affected < 5.25.724.5
5.25.736 affected < 5.25.736.1
7.0.78 affected < 7.0.78.157
7.8.23 affected < 7.8.23.67
7.8.586 affected < 7.8.586.7
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Profiles UI unknown
Version Status Constraints
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.24 affected < 4.8.24.6
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Properties UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.1
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Resources UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.1
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Search UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
x unaffected ≤ *
WSO2 WSO2 Stratos User Interface For Tenant CRUD Operations unknown
Version Status Constraints
4.8.1 affected < 4.8.1.6
4.8.7 affected < 4.8.7.3
4.9.8 affected < 4.9.8.7
4.9.10 affected < 4.9.10.7
4.9.10 affected < 4.9.10.8
4.9.20 affected < 4.9.20.5
4.9.27 affected < 4.9.27.1
4.9.31 affected < 4.9.31.1
4.9.34 affected < 4.9.34.1
4.9.42 affected < 4.9.42.1
4.11.0 affected < 4.11.0.7
4.11.19 affected < 4.11.19.4
4.11.34 affected < 4.11.34.3
4.11.45 affected < 4.11.45.1
x unaffected ≤ *
WSO2 WSO2 Stratos SSO Redirector UI Component unknown
Version Status Constraints
4.8.1 affected < 4.8.1.6
x unaffected ≤ *
WSO2 WSO2 Carbon Email Verification UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.14
x unaffected ≤ *
WSO2 WSO2 Carbon Event Simulator UI unknown
Version Status Constraints
2.2.11 affected < 2.2.11.1
2.2.14 affected < 2.2.14.11
2.2.14 affected < 2.2.14.12
2.2.17 affected < 2.2.17.5
2.3.1 affected < 2.3.1.4
2.3.5 affected < 2.3.5.6
x unaffected ≤ *
WSO2 WSO2 Carbon Execution Manager UI unknown
Version Status Constraints
5.2.24 affected < 5.2.24.10
5.2.26 affected < 5.2.26.22
5.2.34 affected < 5.2.34.12
5.2.41 affected < 5.2.41.7
5.2.57 affected < 5.2.57.10
5.3.5 affected < 5.3.5.9
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Custom Lifecycle Checklist UI unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Generic Artifact User Interface unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
4.8.33 affected < 4.8.33.4
4.8.34 affected < 4.8.34.5
4.8.37 affected < 4.8.37.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Life Cycles User Interface unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance WSDL Tool UI unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
4.8.33 affected < 4.8.33.4
4.8.34 affected < 4.8.34.5
4.8.37 affected < 4.8.37.4
x unaffected ≤ *
WSO2 WSO2 Carbon New Data Sources UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
4.7.24 affected < 4.7.24.5
4.7.32 affected < 4.7.32.10
4.7.35 affected < 4.7.35.13
4.7.49 affected < 4.7.49.7
4.7.52 affected < 4.7.52.5
4.9.2 affected < 4.9.2.8
4.9.11 affected < 4.9.11.2
4.9.18 affected < 4.9.18.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Info UI2 unknown
Version Status Constraints
4.7.32 affected < 4.7.32.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.13 affected < 4.8.13.9
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.50 affected < 4.8.50.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Relations UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.13 affected < 4.8.13.9
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.50 affected < 4.8.50.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Indexing unknown
Version Status Constraints
4.7 affected < 4.7.24
x unaffected ≤ *
WSO2 WSO2 Carbon Security UI unknown
Version Status Constraints
5.14 affected < 5.14.127
x unaffected ≤ *
WSO2 WSO2 Carbon Component Andes Event UI unknown
Version Status Constraints
3.3.12 affected < 3.3.12.3
x unaffected ≤ *
WSO2 WSO2 Carbon Component Andes UI1 unknown
Version Status Constraints
3.3.12 affected < 3.3.12.3
x unaffected ≤ *
WSO2 WSO2 Carbon HL7 Business Messaging Store UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Endpoint Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Publish Event Mediator Configuration UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Eventing UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
x unaffected ≤ *
WSO2 WSO2 Carbon HumanTask UI unknown
Version Status Constraints
4.5.27 affected < 4.5.27.10
x unaffected ≤ *
WSO2 WSO2 Carbon Logging UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
4.7.24 affected < 4.7.24.5
4.7.32 affected < 4.7.32.10
4.7.52 affected < 4.7.52.5
x unaffected ≤ *
WSO2 WSO2 Carbon Template Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Command Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Rule Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Throttle Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Tasks Core unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
x unaffected ≤ *
WSO2 WSO2 Carbon Rest API Admin UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Sequence Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Task UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Governance unknown
Version Status Constraints
4.8.37 affected < 4.8.37.4
x unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/ cve-icon
History

Thu, 06 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Description The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Title Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-08-06T07:33:17.645Z

Reserved: 2025-11-19T06:17:35.259Z

Link: CVE-2025-13394

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T09:30:02Z

Weaknesses