CVE-2025-12317

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

State: Published
Severity: 5.0 Medium
Published: Aug 6, 2026
Updated: Aug 7, 2026
Reserved: Oct 27, 2025

Description

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.

This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	WSO2

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
WSO2 Enterprise IntegratorWSO2	before 6.6.0Unknown 6.6.0 to before 6.6.0.228Affected
WSO2 Identity ServerWSO2	5.11.0 to before 5.11.0.423Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4672/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.