CVE-2024-7097

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

State: Published
Severity: 4.3 Medium
Published: May 30, 2025
Updated: May 30, 2025
Reserved: Jul 25, 2024

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.

Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	WSO2

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
WSO2 Open Banking AMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.131Affected 1.4.0 to before 1.4.0.134Affected 1.5.0 to before 1.5.0.136Affected 2.0.0 to before 2.0.0.343Affected
WSO2 Open Banking KMWSO2	before 1.3.0Unknown 1.3.0 to before 1.3.0.114Affected 1.4.0 to before 1.4.0.130Affected 1.5.0 to before 1.5.0.120Affected
WSO2 Identity Server as Key ManagerWSO2	before 5.3.0Unknown 5.3.0 to before 5.3.0.38Affected 5.5.0 to before 5.5.0.51Affected 5.6.0 to before 5.6.0.72Affected 5.7.0 to before 5.7.0.122Affected 5.9.0 to before 5.9.0.165Affected 5.10.0 to before 5.10.0.312Affected
WSO2 API ManagerWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.29Affected 2.1.0 to before 2.1.0.39Affected 2.2.0 to before 2.2.0.56Affected 2.5.0 to before 2.5.0.83Affected 2.6.0 to before 2.6.0.142Affected 3.0.0 to before 3.0.0.162Affected 3.1.0 to before 3.1.0.294Affected 3.2.0 to before 3.2.0.384Affected 3.2.1 to before 3.2.1.16Affected 4.0.0 to before 4.0.0.305Affected 4.1.0 to before 4.1.0.166Affected 4.2.0 to before 4.2.0.101Affected 4.3.0 to before 4.3.0.16Affected
WSO2 Identity ServerWSO2	before 5.2.0Unknown 5.2.0 to before 5.2.0.32Affected 5.3.0 to before 5.3.0.33Affected 5.4.0 to before 5.4.0.32Affected 5.4.1 to before 5.4.1.36Affected 5.5.0 to before 5.5.0.50Affected 5.6.0 to before 5.6.0.58Affected 5.7.0 to before 5.7.0.123Affected 5.8.0 to before 5.8.0.106Affected 5.9.0 to before 5.9.0.157Affected 5.10.0 to before 5.10.0.318Affected 5.11.0 to before 5.11.0.365Affected 6.0.0 to before 6.0.0.209Affected 6.1.0 to before 6.1.0.188Affected 7.0.0 to before 7.0.0.60Affected
WSO2 Open Banking IAMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.364Affected
WSO2 Enterprise Mobility ManagerWSO2	2.2.0 to before 2.2.0.26Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.