Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

Summary

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.

Remediation

1. Inventory every WSO2 WSO2 API Manager deployment, including staging.
2. Upgrade WSO2 WSO2 API Manager to 1.8.8.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/