CVE-2024-6914

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

State: Published
Severity: 9.8 Critical
Published: May 22, 2025
Updated: Aug 27, 2025
Reserved: Jul 19, 2024

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges.

This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	WSO2
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	WSO2

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 2.2.0Unknown 2.2.0 to before 2.2.0.55Affected 2.5.0 to before 2.5.0.82Affected 2.6.0 to before 2.6.0.141Affected 3.0.0 to before 3.0.0.161Affected 3.1.0 to before 3.1.0.292Affected 3.2.0 to before 3.2.0.382Affected 3.2.1 to before 3.2.1.14Affected 4.0.0 to before 4.0.0.304Affected 4.1.0 to before 4.1.0.164Affected 4.2.0 to before 4.2.0.99Affected 4.3.0 to before 4.3.0.15Affected
WSO2 Governance RegistryWSO2	5.4.0 to before 5.4.0.14Affected
WSO2 Identity ServerWSO2	before 5.3.0Unknown 5.3.0 to before 5.3.0.31Affected 5.4.0 to before 5.4.0.30Affected 5.4.1 to before 5.4.1.35Affected 5.5.0 to before 5.5.0.48Affected 5.6.0 to before 5.6.0.56Affected 5.7.0 to before 5.7.0.122Affected 5.8.0 to before 5.8.0.104Affected 5.9.0 to before 5.9.0.155Affected 5.10.0 to before 5.10.0.317Affected 5.11.0 to before 5.11.0.363Affected 6.0.0 to before 6.0.0.207Affected 6.1.0 to before 6.1.0.184Affected 7.0.0 to before 7.0.0.56Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.3.0Unknown 5.3.0 to before 5.3.0.36Affected 5.5.0 to before 5.5.0.49Affected 5.6.0 to before 5.6.0.70Affected 5.7.0 to before 5.7.0.121Affected 5.9.0 to before 5.9.0.162Affected 5.10.0 to before 5.10.0.311Affected
WSO2 IoTWSO2	3.3.0 to before 3.3.0.59Affected 3.3.1 to before 3.3.1.61Affected
WSO2 Open Banking AMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.130Affected 1.4.0 to before 1.4.0.133Affected 1.5.0 to before 1.5.0.135Affected 2.0.0 to before 2.0.0.341Affected
WSO2 Open banking KMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.113Affected 1.4.0 to before 1.4.0.129Affected 1.5.0 to before 1.5.0.119Affected
WSO2 Open Banking IAMWSO2	2.0.0 to before 2.0.0.362Affected
WSO2 Carbon Identity ManagementWSO2	5.7.5 to before 5.7.5.9Affected 5.10.86 to before 5.10.86.4Affected 5.10.112 to before 5.10.112.14Affected 5.11.148 to before 5.11.148.13Affected 5.11.256 to before 5.11.256.15Affected 5.12.153 to before 5.12.153.58Affected 5.12.387 to before 5.12.387.41Affected 5.14.97 to before 5.14.97.75Affected 5.17.5 to before 5.17.5.282Affected 5.17.118 to before 5.17.118.4Affected 5.18.187 to before 5.18.187.265Affected 5.18.248 to before 5.18.248.14Affected 5.23.8 to before 5.23.8.184Affected 5.24.8 to before 5.24.8.6Affected 5.25.92 to before 5.25.92.92Affected 5.25.705 to before 5.25.705.6Affected 7.0.78 to before 7.0.78.32Affected 7.3.44 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.