{"id":"CVE-2024-7096","state":"PUBLISHED","title":"Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw","description":"A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n  *  SOAP admin services are accessible to the attacker.\n  *  The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n  *  At least one custom role exists with non-default permissions.\n  *  The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.","publishedAt":"2025-05-30T14:54:32.417Z","updatedAt":"2025-12-03T07:47:35.374Z","severity":{"score":4.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 Open Banking IAM","WSO2 WSO2 Open Banking AM","WSO2 WSO2 API Manager","WSO2 WSO2 Enterprise Mobility Manager","WSO2 WSO2 Identity Server","WSO2 WSO2 Identity Server as Key Manager","WSO2 WSO2 Open Banking KM"],"affected":[{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.364","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.131","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.134","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.136","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.343","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.29","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.39","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.56","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.83","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.142","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.162","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.294","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.384","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.16","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.305","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.166","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.101","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.16","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unknown","versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.0.26","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.32","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.33","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.36","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.50","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.58","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.123","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.106","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.157","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.318","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.365","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.209","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.188","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.60","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.51","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.72","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.122","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.165","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.312","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.114","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.130","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.120","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7096.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-7096","state":"PUBLISHED","datePublished":"2025-05-30T14:54:32.417Z","dateUpdated":"2025-12-03T07:47:35.374Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2024-07-25T06:35:14.323Z"},"containers":{"cna":{"title":"Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw","descriptions":[{"lang":"en","value":"A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:\n  *  SOAP admin services are accessible to the attacker.\n  *  The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.\n  *  At least one custom role exists with non-default permissions.\n  *  The attacker has knowledge of the custom role and the internal attribute used in the deployment.\n\n\nExploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms."}],"affected":[{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.364","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.131","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.134","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.136","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.343","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.29","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.39","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.56","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.83","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.142","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.162","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.294","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.384","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.16","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.305","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.166","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.101","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.16","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unknown","versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.0.26","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.32","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.33","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.36","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.50","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.58","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.123","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.106","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.157","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.318","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.365","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.209","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.188","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.60","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.51","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.72","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.122","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.165","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.312","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.3.0","versionType":"custom"},{"version":"1.3.0","status":"affected","lessThan":"1.3.0.114","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.130","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.120","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2025-12-03T07:47:35.374Z"},"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Follow the instructions given on <a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3...</a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/#solution"}],"source":{"advisory":"WSO2-2024-3573","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-30T15:01:23.580052Z","id":"CVE-2024-7096","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-30T15:01:40.977Z"}}]}}}