CVE-2024-7096

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

State: Published
Severity: 4.2 Medium
Published: May 30, 2025
Updated: Dec 3, 2025
Reserved: Jul 25, 2024

Description

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment.

Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	WSO2

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.364Affected
WSO2 Open Banking AMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.131Affected 1.4.0 to before 1.4.0.134Affected 1.5.0 to before 1.5.0.136Affected 2.0.0 to before 2.0.0.343Affected
WSO2 API ManagerWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.29Affected 2.1.0 to before 2.1.0.39Affected 2.2.0 to before 2.2.0.56Affected 2.5.0 to before 2.5.0.83Affected 2.6.0 to before 2.6.0.142Affected 3.0.0 to before 3.0.0.162Affected 3.1.0 to before 3.1.0.294Affected 3.2.0 to before 3.2.0.384Affected 3.2.1 to before 3.2.1.16Affected 4.0.0 to before 4.0.0.305Affected 4.1.0 to before 4.1.0.166Affected 4.2.0 to before 4.2.0.101Affected 4.3.0 to before 4.3.0.16Affected
WSO2 Enterprise Mobility ManagerWSO2	2.2.0 to before 2.2.0.26Affected
WSO2 Identity ServerWSO2	before 5.2.0Unknown 5.2.0 to before 5.2.0.32Affected 5.3.0 to before 5.3.0.33Affected 5.4.1 to before 5.4.1.36Affected 5.5.0 to before 5.5.0.50Affected 5.6.0 to before 5.6.0.58Affected 5.7.0 to before 5.7.0.123Affected 5.8.0 to before 5.8.0.106Affected 5.9.0 to before 5.9.0.157Affected 5.10.0 to before 5.10.0.318Affected 5.11.0 to before 5.11.0.365Affected 6.0.0 to before 6.0.0.209Affected 6.1.0 to before 6.1.0.188Affected 7.0.0 to before 7.0.0.60Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.3.0Unknown 5.3.0 to before 5.3.0.38Affected 5.5.0 to before 5.5.0.51Affected 5.6.0 to before 5.6.0.72Affected 5.7.0 to before 5.7.0.122Affected 5.9.0 to before 5.9.0.165Affected 5.10.0 to before 5.10.0.312Affected
WSO2 Open Banking KMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.114Affected 1.4.0 to before 1.4.0.130Affected 1.5.0 to before 1.5.0.120Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.