CVE-2026-2613

{
  "etk_id": "ETK-2026-3276",
  "cve_id": "CVE-2026-2613",
  "display_id": "CVE-2026-2613",
  "ghsa_id": "GHSA-f56g-9frw-5fc7",
  "euvd_id": "EUVD-2026-115116",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "SQL injection in WSO2 API Manager Admin REST API",
  "summary": "Affected WSO2 API Manager-related deployments expose an SQL injection flaw in the Admin REST API. An attacker with administrator privileges may influence database queries to infer database information and may affect database service availability.",
  "mitigation": "Upgrade deployed WSO2 API Manager, Traffic Manager, API Control Plane, and Universal Gateway components to the applicable listed fixed release; upgrade org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl to 9.33.25. For API Manager, use 4.0.0.387, 4.1.0.251, 4.2.0.191, 4.3.0.102, 4.4.0.66, 4.5.0.51, or 4.6.0.15 as applicable.",
  "vendor": "WSO2",
  "product": "WSO2 API Manager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.0.0.387",
        ">= 4.1.0, < 4.1.0.251",
        ">= 4.2.0, < 4.2.0.191",
        ">= 4.3.0, < 4.3.0.102",
        ">= 4.4.0, < 4.4.0.66",
        ">= 4.5.0, < 4.5.0.51",
        ">= 4.6.0, < 4.6.0.15"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.0.0.387",
        "4.1.0.251",
        "4.2.0.191",
        "4.3.0.102",
        "4.4.0.66",
        "4.5.0.51",
        "4.6.0.15"
      ],
      "package_name": "WSO2 API Manager",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.50",
        ">= 4.6.0, < 4.6.0.15"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.50",
        "4.6.0.15"
      ],
      "package_name": "WSO2 Traffic Manager",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.52",
        ">= 4.6.0, < 4.6.0.16"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.52",
        "4.6.0.16"
      ],
      "package_name": "WSO2 API Control Plane",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.0, < 4.5.0.51",
        ">= 4.6.0, < 4.6.0.15"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.5.0.51",
        "4.6.0.15"
      ],
      "package_name": "WSO2 Universal Gateway",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 9.33.25"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.33.25"
      ],
      "package_name": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 56.317742216666666,
  "t0_at": "2026-11-02T10:11:53.060000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T10:11:53.060000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T10:11:53.060000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2613"
    }
  }
}