{"schema":"threatline.record/2","record":{"id":"CVE-2025-14260","aliases":[],"summary":"Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources","details":"Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.\n\nExploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.","categories":["Unclassified"],"product":"WSO2 API Manager","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.354","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.458","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.99","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.379","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.265","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.205","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.115","versionType":"custom"},{"status":"affected","version":"4.4.0","lessThan":"4.4.0.79","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.374","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.403","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.423","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.383","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.430","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.256","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.257","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.134","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"SAML2 SSO Authenticator UI Bundle","vendor":"WSO2","versions":[{"status":"affected","version":"5.5.0","lessThan":"5.5.0.2","versionType":"custom"},{"status":"affected","version":"5.5.2","lessThan":"5.5.2.5","versionType":"custom"},{"status":"affected","version":"5.5.9","lessThan":"5.5.9.4","versionType":"custom"},{"status":"affected","version":"5.5.10","lessThan":"5.5.10.1","versionType":"custom"},{"status":"affected","version":"5.6.4","lessThan":"5.6.4.1","versionType":"custom"},{"status":"affected","version":"5.7.2","lessThan":"5.7.2.1","versionType":"custom"},{"status":"affected","version":"5.8.3","lessThan":"5.8.3.1","versionType":"custom"},{"status":"affected","version":"5.8.7","lessThan":"5.8.7.2","versionType":"custom"},{"status":"affected","version":"5.9.4","lessThan":"5.9.4.2","versionType":"custom"},{"status":"unaffected","version":"5.9.9","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"WSO2 Carbon UI","vendor":"WSO2","versions":[{"status":"affected","version":"4.6.0","lessThan":"4.6.0.2300","versionType":"custom"},{"status":"affected","version":"4.6.1","lessThan":"4.6.1.165","versionType":"custom"},{"status":"affected","version":"4.6.3","lessThan":"4.6.3.46","versionType":"custom"},{"status":"affected","version":"4.6.4","lessThan":"4.6.4.28","versionType":"custom"},{"status":"affected","version":"4.7.1","lessThan":"4.7.1.79","versionType":"custom"},{"status":"affected","version":"4.8.1","lessThan":"4.8.1.50","versionType":"custom"},{"status":"affected","version":"4.9.0","lessThan":"4.9.0.107","versionType":"custom"},{"status":"affected","version":"4.9.26","lessThan":"4.9.26.37","versionType":"custom"},{"status":"affected","version":"4.9.27","lessThan":"4.9.27.24","versionType":"custom"},{"status":"affected","version":"4.10.9","lessThan":"4.10.9.77","versionType":"custom"},{"status":"unaffected","version":"4.10.42","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.1.0.354","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.458","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.99","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.0.0.379","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.265","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.205","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.115","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.4.0.79","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server as Key Manager","ecosystem":null},"version":"5.10.0.374","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Open Banking AM","ecosystem":null},"version":"2.0.0.403","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Open Banking IAM","ecosystem":null},"version":"2.0.0.423","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.10.0.383","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.11.0.430","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.0.0.256","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.1.0.257","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.0.0.134","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.5.0.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.5.2.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.5.9.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.5.10.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.6.4.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.7.2.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.8.3.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.8.7.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"SAML2 SSO Authenticator UI Bundle","ecosystem":null},"version":"5.9.4.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.6.0.2300","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.6.1.165","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.6.3.46","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.6.4.28","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.7.1.79","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.8.1.50","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.9.0.107","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.9.26.37","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.9.27.24","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","source_modified_at":"2026-10-28T19:21:32.066Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"WSO2 Carbon UI","ecosystem":null},"version":"4.10.9.77","basis":"first unaffected version stated in the CVE record"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:21:32.066Z","modified_at":"2026-10-28T19:21:32.066Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-14260","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:21:32.066Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T19:21:32.066Z","content_hash":"dabc308f4c17a86ddb36b6d73212f3089eba20019ad7530034b4e9ae79900e43"}}