# CVE-2025-11229: Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.

Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

## Remediation

- fix: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/#solution (source: CNA: WSO2)

## Affected products and versions

- WSO2 / WSO2 Identity Server: ≥ 7.0.0; < 7.0.0.125 (affected, custom); ≥ 7.1.0; < 7.1.0.32 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Identity Application Management Component (org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt): ≥ 7.0.78; < 7.0.78.137 (affected, custom); ≥ 7.8.23; < 7.8.23.49 (affected, custom). Source: CNA: WSO2

## Severity and prioritization

- CVSS 3.1: 7.2 (high); CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; source: CNA: WSO2

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-269

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/ (CNA: WSO2; vendor-advisory)

## Provenance

- CNA: WSO2: https://www.cve.org/CVERecord?id=CVE-2025-11229; retrieved 2026-11-04; source updated 2026-11-04

Revision: c0b7db92c7ae05b41e6dfec73cc2cfd7cf48f41dbaca818f55915567f15b2010

Canonical: https://y2.dev/cve/CVE-2025-11229

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.