Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨*CVE* CVE-2025-14779 The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enfo… https://www.cve.org/CVERecord?id=CVE-2025-14779 ----- Traducción: CVE-2025-14779 El … http://infoflow.cloud`
Post summary
The post announces CVE-2025-14779, providing a brief technical overview but no evidence of exploits, PoCs, or patches.
CVE-2025-14779 The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enfo… https://www.cve.org/CVERecord?id=CVE-2025-14779
Post summary
The CVE‑2025‑14779 entry describes an access‑control flaw in a Secret Type Management REST API, without providing proof of concept, exploit code, active exploitation, or remediation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wso2 | identity_server | - | - | - |