CVE-2025-14779: 
WSO2 Identity Server vulnerability analysis and mitigation

CVE-2025-14779 is an improper preservation of permissions vulnerability (CWE-281) in the WSO2 Identity Server Secret Type Management REST API. When an administrator deletes a secret type, the on-delete cascade logic fails to enforce organizational boundaries, resulting in the unintended deletion of secrets across all organizations in the deployment. Affected versions include WSO2 Identity Server 6.0.0 (before 6.0.0.261), 6.1.0 (before 6.1.0.262), and 7.1.0 (before 7.1.0.46), as well as associated org.wso2.carbon.identity.api.server.secret.management component versions. It carries a CVSS v3.1 base score of 3.8 (Low) (GitHub Advisory, WSO2 Advisory).

The root cause is classified as CWE-281 (Improper Preservation of Permissions): the Secret Type Management REST API's cascade deletion logic does not validate or enforce organizational boundaries when removing secrets associated with a deleted secret type. An authenticated administrator with delete permissions on the Secret Type Management REST API can trigger this cross-tenant cascade deletion via a standard DELETE request to the API endpoint. The vulnerability requires high privileges (administrator-level) by default, limiting the attack surface, but in multi-tenant deployments the impact extends beyond the attacker's own organization (GitHub Advisory, WSO2 Advisory).

Successful exploitation allows an authenticated administrator to inadvertently or maliciously delete secrets across all organizations within a WSO2 Identity Server deployment, not just their own. This can cause configuration failures, service interruptions, and denial-of-service conditions for all tenants sharing the deployment. There is no confidentiality impact, but integrity and availability are both affected at a low severity level; the primary risk is data loss of secrets and resulting downstream service disruption in multi-tenant environments (GitHub Advisory, WSO2 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.188% (9th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high privileges (administrator-level delete permissions on the Secret Type Management REST API), which significantly limits the practical attack surface.

1. Obtain Administrator Credentials: Gain access to an account with delete permissions on the Secret Type Management REST API — by default, only administrators hold this permission.
2. Identify Target Deployment: Confirm the WSO2 Identity Server instance is running a vulnerable version (6.0.0 < 6.0.0.261, 6.1.0 < 6.1.0.262, or 7.1.0 < 7.1.0.46).
3. Send DELETE Request: Issue a DELETE request to the Secret Type Management REST API endpoint for a specific secret type (e.g., DELETE /api/server/v1/secret-type/{secret-type-name}) using the administrator's credentials.
4. Trigger Cross-Org Cascade Deletion: The flawed cascade logic executes without enforcing organizational boundaries, deleting all secrets of that type across every organization in the deployment.
5. Observe Impact: Affected organizations experience configuration failures and service interruptions as their secrets are removed (GitHub Advisory, WSO2 Advisory).

• Logs: Audit log entries showing DELETE operations on the Secret Type Management REST API (/api/server/v1/secret-type/) by an administrator account, especially if followed by mass secret deletion events across multiple organizations.
• Application Logs: WSO2 Identity Server logs reflecting bulk secret deletions spanning multiple tenants/organizations in a short time window.
• Configuration/Service: Sudden configuration failures or authentication errors in services that rely on secrets managed by WSO2 Identity Server, particularly across multiple tenants simultaneously.

WSO2 has released patched versions: Identity Server 6.0.0.261, 6.1.0.262, and 7.1.0.46. For the underlying API components, patched versions are org.wso2.carbon.identity.api.server.secret.management.common 1.2.3.7, 1.2.23.11, and 1.3.83.16, and org.wso2.carbon.identity.api.server.secret.management.v1 1.2.3.7, 1.2.23.11, and 1.3.83.16. As a workaround, restrict delete permissions on the Secret Type Management REST API to the minimal set of trusted administrators, review audit logs for unauthorized secret type deletions, and consider implementing approval workflows for secret type deletions in multi-tenant environments (WSO2 Advisory, GitHub Advisory).