{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-03T15:42:10.327","vulnerabilities":[{"cve":{"id":"CVE-2026-4052","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","published":"2026-11-03T08:17:15.530","lastModified":"2026-11-03T08:17:15.530","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint."}],"affected":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","affectedData":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"4.1.0","versionType":"custom","status":"affected"},{"version":"4.2.0","versionType":"custom","status":"affected"},{"version":"4.3.0","versionType":"custom","status":"affected"},{"version":"4.4.0","versionType":"custom","status":"affected"},{"version":"4.5.0","versionType":"custom","status":"affected"},{"version":"4.6.0","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","versionType":"custom","status":"affected"},{"version":"4.6.0","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server Key Manager Connector (apim-km-wso2is)","defaultStatus":"unaffected","packageName":"org.wso2.km.ext.wso2is:wso2is.key.manager.core","versions":[{"version":"0","lessThan":"1.8.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}}]}