Security Advisory WSO2-2026-5680¶

Published: October 28, 2026

Version: 1.0.0

Severity: N/A

CVSS Score: N/A

AFFECTED PRODUCTS¶

• WSO2 APK (API Platform for Kubernetes): 1.3.0

OVERVIEW¶

Essential Security Enhancement.

DESCRIPTION¶

Subscription validation logic in the Gateway Enforcer component has been updated to enforce API subscription checks. Previously, API requests were evaluated against the organization-wide set of subscriptions, rather than those explicitly associated with the calling application. The validation process now ensures that API requests are evaluated against the specific API subscriptions associated with the calling application.

IMPACT¶

The implementation of these security enhancements significantly strengthens the overall protection and integrity of the product, mitigating potential vulnerabilities and ensuring a more robust defense against security threats.

SOLUTION¶

Community Users (Open Source)¶

Migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.

Fixed Product Versions¶