Riskcovery

CVE-2025-9804

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

State
Published
Severity
9.6 Critical
Published
Oct 16, 2025
Updated
Oct 17, 2025
Reserved
Sep 1, 2025

Read the record on cve.org

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Scores

CVSSScoreVectorSource
3.19.6 CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWSO2
3.18.9 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:LWSO2

Weaknesses

Affected Products

ProductVersions
WSO2 Identity Server as Key ManagerWSO2
  • before 5.3.0Unknown
  • 5.3.0 to before 5.3.0.41Affected
  • 5.5.0 to before 5.5.0.53Affected
  • 5.6.0 to before 5.6.0.75Affected
  • 5.7.0 to before 5.7.0.125Affected
  • 5.9.0 to before 5.9.0.176Affected
  • 5.10.0 to before 5.10.0.359Affected
WSO2 Identity ServerWSO2
  • before 5.2.0Unknown
  • 5.2.0 to before 5.2.0.34Affected
  • 5.3.0 to before 5.3.0.36Affected
  • 5.4.0 to before 5.4.0.34Affected
  • 5.4.1 to before 5.4.1.38Affected
  • 5.5.0 to before 5.5.0.52Affected
  • 5.6.0 to before 5.6.0.60Affected
  • 5.7.0 to before 5.7.0.126Affected
  • 5.8.0 to before 5.8.0.110Affected
  • 5.9.0 to before 5.9.0.169Affected
  • 5.10.0 to before 5.10.0.369Affected
  • 5.11.0 to before 5.11.0.413Affected
  • 6.0.0 to before 6.0.0.244Affected
  • 6.1.0 to before 6.1.0.243Affected
  • 7.0.0 to before 7.0.0.118Affected
  • 7.1.0 to before 7.1.0.25Affected
WSO2 Open Banking KMWSO2
  • before 1.4.0Unknown
  • 1.4.0 to before 1.4.0.133Affected
  • 1.5.0 to before 1.5.0.123Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.409Affected
WSO2 Open Banking AMWSO2
  • before 1.4.0Unknown
  • 1.4.0 to before 1.4.0.139Affected
  • 1.5.0 to before 1.5.0.140Affected
  • 2.0.0 to before 2.0.0.389Affected
WSO2 API ManagerWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.31Affected
  • 2.1.0 to before 2.1.0.40Affected
  • 2.2.0 to before 2.2.0.59Affected
  • 2.5.0 to before 2.5.0.85Affected
  • 2.6.0 to before 2.6.0.146Affected
  • 3.0.0 to before 3.0.0.176Affected
  • 3.1.0 to before 3.1.0.340Affected
  • 3.2.0 to before 3.2.0.441Affected
  • 3.2.1 to before 3.2.1.61Affected
  • 4.0.0 to before 4.0.0.361Affected
  • 4.1.0 to before 4.1.0.224Affected
  • 4.2.0 to before 4.2.0.162Affected
  • 4.3.0 to before 4.3.0.75Affected
  • 4.4.0 to before 4.4.0.39Affected
  • 4.5.0 to before 4.5.0.23Affected
WSO2 Identity Server AnalyticsWSO2
  • before 5.2.0Unknown
  • 5.2.0 to before 5.2.0.19Affected
  • 5.3.0 to before 5.3.0.17Affected
  • 5.5.0 to before 5.5.0.31Affected
  • 5.6.0 to before 5.6.0.38Affected
API Manager AnalyticsWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.14Affected
  • 2.1.0 to before 2.1.0.19Affected
  • 2.2.0 to before 2.2.0.30Affected
  • 2.5.0 to before 2.5.0.39Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.2.0Unknown
  • 6.2.0 to before 6.2.0.62Affected
  • 6.3.0 to before 6.3.0.70Affected
WSO2 Enterprise Service Bus AnalyticsWSO2
  • before 5.0.0Unknown
  • 5.0.0 to before 5.0.0.13Affected
WSO2 Data Analytics ServerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.20Affected
  • 3.2.0 to before 3.2.0.33Affected
WSO2 Enterprise Mobility ManagerWSO2
  • before 2.2.0Unknown
  • 2.2.0 to before 2.2.0.28Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.22Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.24Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.22Affected
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connectorWSO2
  • 2.0.10 to before 2.0.10.1Affected
  • 2.0.15 to before 2.0.15.1Affected
  • 2.0.21 to before 2.0.21.1Affected
  • 2.0.22 to before 2.0.22.1Affected
  • 2.1.12 to before 2.1.12.1Affected
  • 2.1 to before 2.1.1972Affected
  • 2.2 to before 2.2.24Affected
  • 2.2 to before 2.2.25Affected
  • 3.1.0 to before 3.1.0.74Affected
  • 3.3.6 to before 3.3.6.7Affected
  • 3.3.26 to before 3.3.26.2Affected
  • 3.3.35 to before 3.3.35.1Affected
  • 3.3.41 and laterNot affected
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.utilWSO2
  • 6.7.206 to before 6.7.206.567Affected
  • 6.7.210 to before 6.7.210.63Affected
  • 9.0.174 to before 9.0.174.522Affected
  • 9.20.74 to before 9.20.74.379Affected
  • 9.28.116 to before 9.28.116.360Affected
  • 9.29.120 to before 9.29.120.184Affected
  • 9.30.67 to before 9.30.67.109Affected
  • 9.31.86 to before 9.31.86.71Affected
  • 9.32.133 and laterNot affected
org.wso2.carbon:org.wso2.carbon.baseWSO2
  • 4.4.7 to before 4.4.7.6Affected
  • 4.4.9 to before 4.4.9.11Affected
  • 4.4.11 to before 4.4.11.9Affected
  • 4.4.26 to before 4.4.26.12Affected
  • 4.4.35 to before 4.4.35.44Affected
  • 4.5.1 to before 4.5.1.43Affected
  • 4.6.0 to before 4.6.0.1990Affected
  • 4.6.1 to before 4.6.1.149Affected
  • 4.6.2 to before 4.6.2.667Affected
  • 4.6.3 to before 4.6.3.36Affected
  • 4.6.4 to before 4.6.4.14Affected
  • 4.7.1 to before 4.7.1.68Affected
  • 4.8.1 to before 4.8.1.39Affected
  • 4.9.0 to before 4.9.0.99Affected
  • 4.9.26 to before 4.9.26.25Affected
  • 4.9.27 to before 4.9.27.10Affected
  • 4.9.28 to before 4.9.28.11Affected
  • 4.10.9 to before 4.10.9.66Affected
  • 4.10.42 to before 4.10.42.9Affected
  • 4.9 to before 4.9.29Affected
  • 4.10 to before 4.10.94Affected
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgtWSO2
  • 5.2.0 to before 5.2.0.4Affected
  • 5.2.2 to before 5.2.2.21Affected
  • 5.7.5 to before 5.7.5.18Affected
  • 5.11.148 to before 5.11.148.19Affected
  • 5.11.256 to before 5.11.256.21Affected
  • 5.12.153 to before 5.12.153.63Affected
  • 5.12.387 to before 5.12.387.46Affected
  • 5.14.97 to before 5.14.97.89Affected
  • 5.17.5 to before 5.17.5.317Affected
  • 5.17.118 to before 5.17.118.17Affected
  • 5.18.187 to before 5.18.187.309Affected
  • 5.18.248 to before 5.18.248.30Affected
  • 5.23.8 to before 5.23.8.207Affected
  • 5.24.8 to before 5.24.8.23Affected
  • 5.25.92 to before 5.25.92.152Affected
  • 5.25.705 to before 5.25.705.19Affected
  • 5.25.713 to before 5.25.713.9Affected
  • 5.25.724 to before 5.25.724.3Affected
  • 7.0.78 to before 7.0.78.133Affected
  • 7.8.23 to before 7.8.23.47Affected
  • 5.25 to before 5.25.734Affected
  • 7.8.489 and laterNot affected
org.wso2.carbon:org.wso2.carbon.server.adminWSO2
  • 4.4.7 to before 4.4.7.6Affected
  • 4.4.9 to before 4.4.9.11Affected
  • 4.4.11 to before 4.4.11.9Affected
  • 4.4.26 to before 4.4.26.12Affected
  • 4.4.32 to before 4.4.32.16Affected
  • 4.4.35 to before 4.4.35.44Affected
  • 4.5.1 to before 4.5.1.43Affected
  • 4.6.0 to before 4.6.0.1990Affected
  • 4.6.1 to before 4.6.1.149Affected
  • 4.6.2 to before 4.6.2.667Affected
  • 4.6.3 to before 4.6.3.36Affected
  • 4.6.4 to before 4.6.4.14Affected
  • 4.7.1 to before 4.7.1.68Affected
  • 4.8.1 to before 4.8.1.39Affected
  • 4.9.0 to before 4.9.0.99Affected
  • 4.9.26 to before 4.9.26.25Affected
  • 4.9.27 to before 4.9.27.10Affected
  • 4.9.28 to before 4.9.28.11Affected
  • 4.10.9 to before 4.10.9.66Affected
  • 4.10.42 to before 4.10.42.9Affected
  • 4.9 to before 4.9.29Affected
  • 4.10 to before 4.10.94Affected
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflowWSO2
  • 5.1.1 to before 5.1.1.1Affected
  • 5.1.2 to before 5.1.2.1Affected
  • 5.1.5 to before 5.1.5.1Affected
  • 5.3.3 to before 5.3.3.1Affected
  • 5.4.0 to before 5.4.0.4Affected
  • 5.4.1 to before 5.4.1.5Affected
  • 5.6.0 to before 5.6.0.1Affected
  • 5.6.21 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.