The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.

An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00114.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.381
5.11.0 affected < 5.11.0.428
6.0.0 affected < 6.0.0.255
6.1.0 affected < 6.1.0.256
7.0.0 affected < 7.0.0.133
7.1.0 affected < 7.1.0.41
7.2.0 affected < 7.2.0.3
WSO2 WSO2 API Manager unaffected
Version Status Constraints
0 unknown < 3.1.0
3.1.0 affected < 3.1.0.352
3.2.0 affected < 3.2.0.456
3.2.1 affected < 3.2.1.75
4.0.0 affected < 4.0.0.376
4.1.0 affected < 4.1.0.239
4.2.0 affected < 4.2.0.179
4.3.0 affected < 4.3.0.91
4.4.0 affected < 4.4.0.55
4.5.0 affected < 4.5.0.38
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Open Banking IAM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.421
WSO2 WSO2 Open Banking AM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.401
WSO2 WSO2 Identity Server as Key Manager unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.372
WSO2 WSO2 API Control Plane unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.39
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Universal Gateway unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.37
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Traffic Manager unaffected
Version Status Constraints
0 unknown < 4.5.0
4.5.0 affected < 4.5.0.37
4.6.0 affected < 4.6.0.3
WSO2 WSO2 Enterprise Integrator unaffected
Version Status Constraints
0 unknown < 6.6.0
6.6.0 affected < 6.6.0.227
WSO2 WSO2 Carbon Identity Entitlement UI unknown
Version Status Constraints
5.17.5 affected < 5.17.5.331
5.18.187 affected < 5.18.187.329
5.23.8 affected < 5.23.8.210
5.25.92 affected < 5.25.92.166
7.0.78 affected < 7.0.78.157
x unaffected ≤ *
WSO2 WSO2 Carbon Identity Management UI1 unknown
Version Status Constraints
5.17.5 affected < 5.17.5.330
5.17.5 affected < 5.17.5.331
5.17.118 affected < 5.17.118.22
5.18.187 affected < 5.18.187.328
5.18.187 affected < 5.18.187.329
5.18.248 affected < 5.18.248.31
5.23.8 affected < 5.23.8.210
5.24.8 affected < 5.24.8.26
5.25.92 affected < 5.25.92.166
5.25.705 affected < 5.25.705.21
5.25.713 affected < 5.25.713.10
5.25.724 affected < 5.25.724.5
5.25.736 affected < 5.25.736.1
7.0.78 affected < 7.0.78.157
7.8.23 affected < 7.8.23.67
7.8.586 affected < 7.8.586.7
x unaffected ≤ *
WSO2 WSO2 Carbon Identity User Store Configuration UI unknown
Version Status Constraints
5.14.127 affected < 5.14.127.13
5.17.5 affected < 5.17.5.330
5.17.5 affected < 5.17.5.331
5.17.118 affected < 5.17.118.22
5.18.187 affected < 5.18.187.328
5.18.187 affected < 5.18.187.329
5.18.248 affected < 5.18.248.31
5.23.8 affected < 5.23.8.210
5.24.8 affected < 5.24.8.26
5.25.92 affected < 5.25.92.166
5.25.705 affected < 5.25.705.21
5.25.713 affected < 5.25.713.10
5.25.724 affected < 5.25.724.5
5.25.736 affected < 5.25.736.1
7.0.78 affected < 7.0.78.157
7.8.23 affected < 7.8.23.67
7.8.586 affected < 7.8.586.7
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Profiles UI unknown
Version Status Constraints
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.24 affected < 4.8.24.6
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Properties UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.1
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Resources UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.43 affected < 4.8.43.4
4.8.50 affected < 4.8.50.1
4.8.50 affected < 4.8.50.3
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Search UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.32 affected < 4.7.32.18
4.7.33 affected < 4.7.33.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.9 affected < 4.8.9.16
4.8.12 affected < 4.8.12.8
4.8.13 affected < 4.8.13.9
4.8.24 affected < 4.8.24.6
x unaffected ≤ *
WSO2 WSO2 Stratos User Interface For Tenant CRUD Operations unknown
Version Status Constraints
4.8.1 affected < 4.8.1.6
4.8.7 affected < 4.8.7.3
4.9.8 affected < 4.9.8.7
4.9.10 affected < 4.9.10.7
4.9.10 affected < 4.9.10.8
4.9.20 affected < 4.9.20.5
4.9.27 affected < 4.9.27.1
4.9.31 affected < 4.9.31.1
4.9.34 affected < 4.9.34.1
4.9.42 affected < 4.9.42.1
4.11.0 affected < 4.11.0.7
4.11.19 affected < 4.11.19.4
4.11.34 affected < 4.11.34.3
4.11.45 affected < 4.11.45.1
x unaffected ≤ *
WSO2 WSO2 Stratos SSO Redirector UI Component unknown
Version Status Constraints
4.8.1 affected < 4.8.1.6
x unaffected ≤ *
WSO2 WSO2 Carbon Email Verification UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.14
x unaffected ≤ *
WSO2 WSO2 Carbon Event Simulator UI unknown
Version Status Constraints
2.2.11 affected < 2.2.11.1
2.2.14 affected < 2.2.14.11
2.2.14 affected < 2.2.14.12
2.2.17 affected < 2.2.17.5
2.3.1 affected < 2.3.1.4
2.3.5 affected < 2.3.5.6
x unaffected ≤ *
WSO2 WSO2 Carbon Execution Manager UI unknown
Version Status Constraints
5.2.24 affected < 5.2.24.10
5.2.26 affected < 5.2.26.22
5.2.34 affected < 5.2.34.12
5.2.41 affected < 5.2.41.7
5.2.57 affected < 5.2.57.10
5.3.5 affected < 5.3.5.9
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Custom Lifecycle Checklist UI unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Generic Artifact User Interface unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
4.8.33 affected < 4.8.33.4
4.8.34 affected < 4.8.34.5
4.8.37 affected < 4.8.37.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance Life Cycles User Interface unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
x unaffected ≤ *
WSO2 WSO2 Carbon Governance WSDL Tool UI unknown
Version Status Constraints
4.8.14 affected < 4.8.14.4
4.8.19 affected < 4.8.19.8
4.8.21 affected < 4.8.21.10
4.8.28 affected < 4.8.28.4
4.8.30 affected < 4.8.30.6
4.8.32 affected < 4.8.32.4
4.8.33 affected < 4.8.33.4
4.8.34 affected < 4.8.34.5
4.8.37 affected < 4.8.37.4
x unaffected ≤ *
WSO2 WSO2 Carbon New Data Sources UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
4.7.24 affected < 4.7.24.5
4.7.32 affected < 4.7.32.10
4.7.35 affected < 4.7.35.13
4.7.49 affected < 4.7.49.7
4.7.52 affected < 4.7.52.5
4.9.2 affected < 4.9.2.8
4.9.11 affected < 4.9.11.2
4.9.18 affected < 4.9.18.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Info UI2 unknown
Version Status Constraints
4.7.32 affected < 4.7.32.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.13 affected < 4.8.13.9
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.50 affected < 4.8.50.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Relations UI unknown
Version Status Constraints
4.7.24 affected < 4.7.24.11
4.7.32 affected < 4.7.32.16
4.7.35 affected < 4.7.35.15
4.7.39 affected < 4.7.39.12
4.7.51 affected < 4.7.51.8
4.8.3 affected < 4.8.3.10
4.8.13 affected < 4.8.13.9
4.8.32 affected < 4.8.32.4
4.8.36 affected < 4.8.36.2
4.8.43 affected < 4.8.43.2
4.8.50 affected < 4.8.50.1
x unaffected ≤ *
WSO2 WSO2 Carbon Registry Indexing unknown
Version Status Constraints
4.7 affected < 4.7.24
x unaffected ≤ *
WSO2 WSO2 Carbon Security UI unknown
Version Status Constraints
5.14 affected < 5.14.127
x unaffected ≤ *
WSO2 WSO2 Carbon Component Andes Event UI unknown
Version Status Constraints
3.3.12 affected < 3.3.12.3
x unaffected ≤ *
WSO2 WSO2 Carbon Component Andes UI1 unknown
Version Status Constraints
3.3.12 affected < 3.3.12.3
x unaffected ≤ *
WSO2 WSO2 Carbon HL7 Business Messaging Store UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Endpoint Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Publish Event Mediator Configuration UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Eventing UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
x unaffected ≤ *
WSO2 WSO2 Carbon HumanTask UI unknown
Version Status Constraints
4.5.27 affected < 4.5.27.10
x unaffected ≤ *
WSO2 WSO2 Carbon Logging UI unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
4.7.24 affected < 4.7.24.5
4.7.32 affected < 4.7.32.10
4.7.52 affected < 4.7.52.5
x unaffected ≤ *
WSO2 WSO2 Carbon Template Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Command Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Rule Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Throttle Mediator UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Tasks Core unknown
Version Status Constraints
4.7.19 affected < 4.7.19.13
x unaffected ≤ *
WSO2 WSO2 Carbon Rest API Admin UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Sequence Editor UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Task UI unknown
Version Status Constraints
4.7.30 affected < 4.7.30.53
x unaffected ≤ *
WSO2 WSO2 Carbon Governance unknown
Version Status Constraints
4.8.37 affected < 4.8.37.4
x unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Wso2 Subscribe
Wso2 Api Control Plane Subscribe
Wso2 Api Manager Subscribe
Wso2 Carbon Command Mediator Ui Subscribe
Wso2 Carbon Component Andes Event Ui Subscribe
Wso2 Carbon Component Andes Ui1 Subscribe
Wso2 Carbon Email Verification Ui Subscribe
Wso2 Carbon Endpoint Editor Ui Subscribe
Wso2 Carbon Event Simulator Ui Subscribe
Wso2 Carbon Eventing Ui Subscribe
Wso2 Carbon Execution Manager Ui Subscribe
Wso2 Carbon Governance Subscribe
Wso2 Carbon Governance Custom Lifecycle Checklist Ui Subscribe
Wso2 Carbon Governance Generic Artifact User Interface Subscribe
Wso2 Carbon Governance Life Cycles User Interface Subscribe
Wso2 Carbon Governance Wsdl Tool Ui Subscribe
Wso2 Carbon Hl7 Business Messaging Store Ui Subscribe
Wso2 Carbon Humantask Ui Subscribe
Wso2 Carbon Identity Entitlement Ui Subscribe
Wso2 Carbon Identity Management Ui1 Subscribe
Wso2 Carbon Identity User Store Configuration Ui Subscribe
Wso2 Carbon Logging Ui Subscribe
Wso2 Carbon New Data Sources Ui Subscribe
Wso2 Carbon Publish Event Mediator Configuration Ui Subscribe
Wso2 Carbon Registry Indexing Subscribe
Wso2 Carbon Registry Info Ui2 Subscribe
Wso2 Carbon Registry Profiles Ui Subscribe
Wso2 Carbon Registry Properties Ui Subscribe
Wso2 Carbon Registry Relations Ui Subscribe
Wso2 Carbon Registry Resources Ui Subscribe
Wso2 Carbon Registry Search Ui Subscribe
Wso2 Carbon Rest Api Admin Ui Subscribe
Wso2 Carbon Rule Mediator Ui Subscribe
Wso2 Carbon Security Ui Subscribe
Wso2 Carbon Sequence Editor Ui Subscribe
Wso2 Carbon Task Ui Subscribe
Wso2 Carbon Tasks Core Subscribe
Wso2 Carbon Template Editor Ui Subscribe
Wso2 Carbon Throttle Mediator Ui Subscribe
Wso2 Enterprise Integrator Subscribe
Wso2 Identity Server Subscribe
Wso2 Identity Server As Key Manager Subscribe
Wso2 Open Banking Am Subscribe
Wso2 Open Banking Iam Subscribe
Wso2 Stratos Sso Redirector Ui Component Subscribe
Wso2 Stratos User Interface For Tenant Crud Operations Subscribe
Wso2 Traffic Manager Subscribe
Wso2 Universal Gateway Subscribe

Project Subscriptions

Vendors Products
Wso2 Subscribe
Wso2 Api Control Plane Subscribe
Wso2 Api Manager Subscribe
Wso2 Carbon Command Mediator Ui Subscribe
Wso2 Carbon Component Andes Event Ui Subscribe
Wso2 Carbon Component Andes Ui1 Subscribe
Wso2 Carbon Email Verification Ui Subscribe
Wso2 Carbon Endpoint Editor Ui Subscribe
Wso2 Carbon Event Simulator Ui Subscribe
Wso2 Carbon Eventing Ui Subscribe
Wso2 Carbon Execution Manager Ui Subscribe
Wso2 Carbon Governance Subscribe
Wso2 Carbon Governance Custom Lifecycle Checklist Ui Subscribe
Wso2 Carbon Governance Generic Artifact User Interface Subscribe
Wso2 Carbon Governance Life Cycles User Interface Subscribe
Wso2 Carbon Governance Wsdl Tool Ui Subscribe
Wso2 Carbon Hl7 Business Messaging Store Ui Subscribe
Wso2 Carbon Humantask Ui Subscribe
Wso2 Carbon Identity Entitlement Ui Subscribe
Wso2 Carbon Identity Management Ui1 Subscribe
Wso2 Carbon Identity User Store Configuration Ui Subscribe
Wso2 Carbon Logging Ui Subscribe
Wso2 Carbon New Data Sources Ui Subscribe
Wso2 Carbon Publish Event Mediator Configuration Ui Subscribe
Wso2 Carbon Registry Indexing Subscribe
Wso2 Carbon Registry Info Ui2 Subscribe
Wso2 Carbon Registry Profiles Ui Subscribe
Wso2 Carbon Registry Properties Ui Subscribe
Wso2 Carbon Registry Relations Ui Subscribe
Wso2 Carbon Registry Resources Ui Subscribe
Wso2 Carbon Registry Search Ui Subscribe
Wso2 Carbon Rest Api Admin Ui Subscribe
Wso2 Carbon Rule Mediator Ui Subscribe
Wso2 Carbon Security Ui Subscribe
Wso2 Carbon Sequence Editor Ui Subscribe
Wso2 Carbon Task Ui Subscribe
Wso2 Carbon Tasks Core Subscribe
Wso2 Carbon Template Editor Ui Subscribe
Wso2 Carbon Throttle Mediator Ui Subscribe
Wso2 Enterprise Integrator Subscribe
Wso2 Identity Server Subscribe
Wso2 Identity Server As Key Manager Subscribe
Wso2 Open Banking Am Subscribe
Wso2 Open Banking Iam Subscribe
Wso2 Stratos Sso Redirector Ui Component Subscribe
Wso2 Stratos User Interface For Tenant Crud Operations Subscribe
Wso2 Traffic Manager Subscribe
Wso2 Universal Gateway Subscribe
Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/ cve-icon
History

Fri, 07 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Wso2
Wso2 wso2 Api Control Plane
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Command Mediator Ui
Wso2 wso2 Carbon Component Andes Event Ui
Wso2 wso2 Carbon Component Andes Ui1
Wso2 wso2 Carbon Email Verification Ui
Wso2 wso2 Carbon Endpoint Editor Ui
Wso2 wso2 Carbon Event Simulator Ui
Wso2 wso2 Carbon Eventing Ui
Wso2 wso2 Carbon Execution Manager Ui
Wso2 wso2 Carbon Governance
Wso2 wso2 Carbon Governance Custom Lifecycle Checklist Ui
Wso2 wso2 Carbon Governance Generic Artifact User Interface
Wso2 wso2 Carbon Governance Life Cycles User Interface
Wso2 wso2 Carbon Governance Wsdl Tool Ui
Wso2 wso2 Carbon Hl7 Business Messaging Store Ui
Wso2 wso2 Carbon Humantask Ui
Wso2 wso2 Carbon Identity Entitlement Ui
Wso2 wso2 Carbon Identity Management Ui1
Wso2 wso2 Carbon Identity User Store Configuration Ui
Wso2 wso2 Carbon Logging Ui
Wso2 wso2 Carbon New Data Sources Ui
Wso2 wso2 Carbon Publish Event Mediator Configuration Ui
Wso2 wso2 Carbon Registry Indexing
Wso2 wso2 Carbon Registry Info Ui2
Wso2 wso2 Carbon Registry Profiles Ui
Wso2 wso2 Carbon Registry Properties Ui
Wso2 wso2 Carbon Registry Relations Ui
Wso2 wso2 Carbon Registry Resources Ui
Wso2 wso2 Carbon Registry Search Ui
Wso2 wso2 Carbon Rest Api Admin Ui
Wso2 wso2 Carbon Rule Mediator Ui
Wso2 wso2 Carbon Security Ui
Wso2 wso2 Carbon Sequence Editor Ui
Wso2 wso2 Carbon Task Ui
Wso2 wso2 Carbon Tasks Core
Wso2 wso2 Carbon Template Editor Ui
Wso2 wso2 Carbon Throttle Mediator Ui
Wso2 wso2 Enterprise Integrator
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
Wso2 wso2 Stratos Sso Redirector Ui Component
Wso2 wso2 Stratos User Interface For Tenant Crud Operations
Wso2 wso2 Traffic Manager
Wso2 wso2 Universal Gateway
Vendors & Products Wso2
Wso2 wso2 Api Control Plane
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Command Mediator Ui
Wso2 wso2 Carbon Component Andes Event Ui
Wso2 wso2 Carbon Component Andes Ui1
Wso2 wso2 Carbon Email Verification Ui
Wso2 wso2 Carbon Endpoint Editor Ui
Wso2 wso2 Carbon Event Simulator Ui
Wso2 wso2 Carbon Eventing Ui
Wso2 wso2 Carbon Execution Manager Ui
Wso2 wso2 Carbon Governance
Wso2 wso2 Carbon Governance Custom Lifecycle Checklist Ui
Wso2 wso2 Carbon Governance Generic Artifact User Interface
Wso2 wso2 Carbon Governance Life Cycles User Interface
Wso2 wso2 Carbon Governance Wsdl Tool Ui
Wso2 wso2 Carbon Hl7 Business Messaging Store Ui
Wso2 wso2 Carbon Humantask Ui
Wso2 wso2 Carbon Identity Entitlement Ui
Wso2 wso2 Carbon Identity Management Ui1
Wso2 wso2 Carbon Identity User Store Configuration Ui
Wso2 wso2 Carbon Logging Ui
Wso2 wso2 Carbon New Data Sources Ui
Wso2 wso2 Carbon Publish Event Mediator Configuration Ui
Wso2 wso2 Carbon Registry Indexing
Wso2 wso2 Carbon Registry Info Ui2
Wso2 wso2 Carbon Registry Profiles Ui
Wso2 wso2 Carbon Registry Properties Ui
Wso2 wso2 Carbon Registry Relations Ui
Wso2 wso2 Carbon Registry Resources Ui
Wso2 wso2 Carbon Registry Search Ui
Wso2 wso2 Carbon Rest Api Admin Ui
Wso2 wso2 Carbon Rule Mediator Ui
Wso2 wso2 Carbon Security Ui
Wso2 wso2 Carbon Sequence Editor Ui
Wso2 wso2 Carbon Task Ui
Wso2 wso2 Carbon Tasks Core
Wso2 wso2 Carbon Template Editor Ui
Wso2 wso2 Carbon Throttle Mediator Ui
Wso2 wso2 Enterprise Integrator
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
Wso2 wso2 Stratos Sso Redirector Ui Component
Wso2 wso2 Stratos User Interface For Tenant Crud Operations
Wso2 wso2 Traffic Manager
Wso2 wso2 Universal Gateway

Thu, 06 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Description The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Title Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-08-06T12:32:29.065Z

Reserved: 2025-11-19T06:17:35.259Z

Link: CVE-2025-13394

cve-icon Vulnrichment

Updated: 2026-08-06T12:32:26.203Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T10:01:12Z

Weaknesses