External risk intelligence

Publisher API Tenant Isolation Bypass in Multi-Tenant Deployments.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2025-14561

The vulnerability affects Publisher REST APIs, which are typically deployed as internet-facing management or developer interfaces for API gateways. While it requires authenticated privileged access, these endpoints are commonly exposed in multi-tenant cloud or API management deployments to facilitate remote service administration.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Publisher REST APIs used in multi-tenant environments. It could allow a privileged user in one tenant to access or alter API metadata in another tenant, impacting data confidentiality and integrity. The main concern is confirming relevance and exposure within our multi-tenant deployments.

Tenants can improperly access each other's APIs.
It could expose or modify sensitive API data.
Confirm relevance to our multi-tenant environments.

Attack Path

How an attacker could exploit the issue

An attacker with privileged access within a multi-tenant environment can exploit a flaw in the Publisher REST APIs. These APIs, intended for managing API metadata, do not properly distinguish between different tenants. By leveraging this, an attacker can access and alter API information belonging to other tenants, leading to significant disruption.

Requires authenticated privileged access.
Exploits Publisher REST APIs.
Unauthorized tenant data modification.

Live Threat

Current exploitation, exposure, and threat context

In multi-tenant environments, this vulnerability could allow a privileged user in one tenant to access or alter API metadata belonging to other tenants. This impact is contingent on the system's multi-tenant configuration and the user's existing privileges to interact with the Publisher REST APIs.

API metadata in other tenants.
Privileged user invokes APIs.
Unauthorized API exposure or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

In multi-tenant environments, the Publisher REST APIs' failure to enforce tenant isolation means privileged users could impact other tenants. This risk is specific to deployments where these APIs are accessible and used across multiple tenants. The first step is to identify all instances of the affected technology, confirm their exposure and business criticality, assign an owner, and then plan remediation.

Application or platform teams own the issue.
Verify API reachability and tenant isolation.
Plan phased remediation based on criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WSO2 Publisher REST API software?

WSO2 Publisher REST APIs serve as the management interface for API developers and administrators. They allow users to create, configure, and oversee API metadata, such as endpoint definitions and security policies. In enterprise environments, these APIs function as a central control plane for managing the lifecycle and distribution of digital services.

What does CWE-284 mean for CVE-2025-14561?

CWE-284 represents improper access control. In the context of this CVE, it means the software fails to correctly restrict a user's actions to their own assigned organizational space. Even though a user is authenticated, the system lacks the technical boundaries to prevent them from performing operations in areas they should not be able to reach.

How does an attacker trigger this vulnerability?

An attacker triggers this by using existing, legitimate administrative credentials to interact with the Publisher REST APIs. Crucially, this bug does not trigger in single-tenant deployments, as the isolation failure is specific to multi-tenant architectures where shared resources must be siloed.

Why is this CVE concerning for my infrastructure?

Halo Surface Signal identifies this as a significant concern because Publisher REST APIs are frequently exposed to the internet to support remote management and developer workflows. If your organization hosts multiple tenants on a shared WSO2 deployment, a compromised or malicious privileged account could potentially view or alter the API metadata of other customers.

What is the first step to address this issue?

Start by identifying all deployed instances of the WSO2 Publisher and confirming if they are configured for multi-tenancy. Since this vulnerability requires specific administrative privileges, coordinate with your platform team to audit current user roles, verify which services are internet-facing, and prepare to apply vendor-supplied patches as they become available.

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.