CVE-2025-13475: WSO2 Cross-Tenant Consent Isolation Vulnerability

Technical summary

The vulnerability stems from insufficient scope isolation in the application consent management mechanism. When a user grants consent to a SaaS application, the system fails to properly namespace or validate that consent against the tenant boundary. An identically-named application in a different tenant can inherit or reuse that consent decision, bypassing the intended per-tenant authorization model. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), reflecting the consent framework's failure to enforce proper authorization boundaries.

Business impact

In multi-tenant SaaS environments, this vulnerability creates a privacy and data protection risk. User data can be accessed by applications in other customer tenants without explicit consent, potentially exposing sensitive information across organizational boundaries. For service providers, this introduces regulatory compliance exposure under GDPR, CCPA, and similar data protection regimes, as well as breach notification obligations. Customer trust and contractual commitments around data isolation are undermined. Single-tenant deployments face no business impact.

Affected systems

WSO2 API Manager and WSO2 Identity Server are affected. The vulnerability manifests only in multi-tenant deployment configurations. Organizations running these products in single-tenant mode are not vulnerable. Verify the specific affected version numbers against the WSO2 security advisory.

Exploitability

Exploitation requires authenticated user interaction (PR:L, UI:R in the CVSS vector). An attacker must operate within the tenant context and rely on a user clicking or interacting with a consent prompt. The network attack surface is unrestricted (AV:N), but the requirement for both authentication and user interaction significantly constrains practical exploitation. No known public exploit is tracked in the KEV catalog. The low CVSS score (3.5) reflects the limited confidentiality impact and necessary user involvement.

Remediation

Organizations running WSO2 API Manager or WSO2 Identity Server in multi-tenant mode should prioritize patching. Consult the WSO2 security advisory for the specific patched versions. For high-risk environments where patching is delayed, mitigations may include restricting multi-tenant deployments, implementing additional consent validation logic at the application layer, and conducting user consent audits to identify unauthorized cross-tenant access. Single-tenant deployments require no action.

Patch guidance

Refer to the official WSO2 security advisory for the exact patched versions of API Manager and Identity Server. Apply patches in a controlled manner, testing first in non-production multi-tenant environments. Verify that consent isolation is correctly enforced post-patch by reviewing tenant-specific consent audit logs.

Detection guidance

Monitor consent grant events and cross-reference the tenant ID and application name to identify instances where the same application name appears in multiple tenants but with identical consent records. Review access logs for SaaS application API calls that originate from consent records not explicitly created in the calling tenant. Implement logging that captures the tenant context at consent decision time and application access time.

Why prioritize this

Although the CVSS score is low, the risk is elevated for organizations that (1) operate multi-tenant deployments, (2) process sensitive user data, or (3) face strict data isolation contractual requirements. Single-tenant operators can safely deprioritize. For multi-tenant providers, this should be addressed within standard patch cycles to restore customer trust and regulatory compliance.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW severity) reflects limited confidentiality impact (C:L), no integrity or availability impact, and high barriers to exploitation (authenticated user with required interaction). However, the scope of impact—privacy violations and cross-tenant data exposure—may warrant internal risk elevation for multi-tenant deployments depending on organizational sensitivity and regulatory environment.

Frequently asked questions