CVE-2025-14779
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.
Scoring
- Severity
- LOW
- CVSS base score
- 3.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- EPSS probability
- 0.19%
- CWE
- CWE-281
- Published
- 2026-08-06
- Last modified
- 2026-08-06
Affected products
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Carbon Identity API Server Secret Management Common
- WSO2 WSO2 Carbon Identity API Server Secret Management Common
- WSO2 WSO2 Carbon Identity API Server Secret Management Common
- WSO2 WSO2 Carbon Identity API Server Secret Management Common
- WSO2 WSO2 Carbon Identity API Server Secret Management V1
Weakness type
Related vulnerabilities
- CVE-2026-88016 — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- CVE-2026-58510 — GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2026-23556 — oxenstored keeps quota related use counts across domain destruction
- CVE-2026-58494 — Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- CVE-2026-4360 — Tarfile.extract() doesn't fully respect filter parameter
- CVE-2026-44947 — Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
- CVE-2026-40767 — WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
- CVE-2024-47270 — Improper preservation of permissions vulnerability in Archiving Push functionality in Synology...