Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2025-9804

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.3.0unknown
  • 5.3.0 to < 5.3.0.41affected
  • 5.5.0 to < 5.5.0.53affected
  • 5.6.0 to < 5.6.0.75affected
  • 5.7.0 to < 5.7.0.125affected
  • 5.9.0 to < 5.9.0.176affected
  • 5.10.0 to < 5.10.0.359affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.2.0unknown
  • 5.2.0 to < 5.2.0.34affected
  • 5.3.0 to < 5.3.0.36affected
  • 5.4.0 to < 5.4.0.34affected
  • 5.4.1 to < 5.4.1.38affected
  • 5.5.0 to < 5.5.0.52affected
  • 5.6.0 to < 5.6.0.60affected
  • 5.7.0 to < 5.7.0.126affected
  • 5.8.0 to < 5.8.0.110affected
  • 5.9.0 to < 5.9.0.169affected
  • 5.10.0 to < 5.10.0.369affected
  • 5.11.0 to < 5.11.0.413affected
  • 6.0.0 to < 6.0.0.244affected
  • 6.1.0 to < 6.1.0.243affected
  • 7.0.0 to < 7.0.0.118affected
  • 7.1.0 to < 7.1.0.25affected

WSO2 WSO2 Open Banking KM

Default version status: unaffected

  • 0 to < 1.4.0unknown
  • 1.4.0 to < 1.4.0.133affected
  • 1.5.0 to < 1.5.0.123affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.409affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 1.4.0unknown
  • 1.4.0 to < 1.4.0.139affected
  • 1.5.0 to < 1.5.0.140affected
  • 2.0.0 to < 2.0.0.389affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.31affected
  • 2.1.0 to < 2.1.0.40affected
  • 2.2.0 to < 2.2.0.59affected
  • 2.5.0 to < 2.5.0.85affected
  • 2.6.0 to < 2.6.0.146affected
  • 3.0.0 to < 3.0.0.176affected
  • 3.1.0 to < 3.1.0.340affected
  • 3.2.0 to < 3.2.0.441affected
  • 3.2.1 to < 3.2.1.61affected
  • 4.0.0 to < 4.0.0.361affected
  • 4.1.0 to < 4.1.0.224affected
  • 4.2.0 to < 4.2.0.162affected
  • 4.3.0 to < 4.3.0.75affected
  • 4.4.0 to < 4.4.0.39affected
  • 4.5.0 to < 4.5.0.23affected

WSO2 WSO2 Identity Server Analytics

Default version status: unaffected

  • 0 to < 5.2.0unknown
  • 5.2.0 to < 5.2.0.19affected
  • 5.3.0 to < 5.3.0.17affected
  • 5.5.0 to < 5.5.0.31affected
  • 5.6.0 to < 5.6.0.38affected

WSO2 API Manager Analytics

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.14affected
  • 2.1.0 to < 2.1.0.19affected
  • 2.2.0 to < 2.2.0.30affected
  • 2.5.0 to < 2.5.0.39affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.2.0unknown
  • 6.2.0 to < 6.2.0.62affected
  • 6.3.0 to < 6.3.0.70affected

WSO2 WSO2 Enterprise Service Bus Analytics

Default version status: unaffected

  • 0 to < 5.0.0unknown
  • 5.0.0 to < 5.0.0.13affected

WSO2 WSO2 Data Analytics Server

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.20affected
  • 3.2.0 to < 3.2.0.33affected

WSO2 WSO2 Enterprise Mobility Manager

Default version status: unaffected

  • 0 to < 2.2.0unknown
  • 2.2.0 to < 2.2.0.28affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.22affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.24affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.22affected

WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector

Default version status: unknown

  • 2.0.10 to < 2.0.10.1affected
  • 2.0.15 to < 2.0.15.1affected
  • 2.0.21 to < 2.0.21.1affected
  • 2.0.22 to < 2.0.22.1affected
  • 2.1.12 to < 2.1.12.1affected
  • 2.1 to < 2.1.1972affected
  • 2.2 to < 2.2.24affected
  • 2.2 to < 2.2.25affected
  • 3.1.0 to < 3.1.0.74affected
  • 3.3.6 to < 3.3.6.7affected
  • 3.3.26 to < 3.3.26.2affected
  • 3.3.35 to < 3.3.35.1affected
  • 3.3.41 to ≤ *unaffected

WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

Default version status: unknown

  • 6.7.206 to < 6.7.206.567affected
  • 6.7.210 to < 6.7.210.63affected
  • 9.0.174 to < 9.0.174.522affected
  • 9.20.74 to < 9.20.74.379affected
  • 9.28.116 to < 9.28.116.360affected
  • 9.29.120 to < 9.29.120.184affected
  • 9.30.67 to < 9.30.67.109affected
  • 9.31.86 to < 9.31.86.71affected
  • 9.32.133 to ≤ *unaffected

WSO2 org.wso2.carbon:org.wso2.carbon.base

Default version status: unknown

  • 4.4.7 to < 4.4.7.6affected
  • 4.4.9 to < 4.4.9.11affected
  • 4.4.11 to < 4.4.11.9affected
  • 4.4.26 to < 4.4.26.12affected
  • 4.4.35 to < 4.4.35.44affected
  • 4.5.1 to < 4.5.1.43affected
  • 4.6.0 to < 4.6.0.1990affected
  • 4.6.1 to < 4.6.1.149affected
  • 4.6.2 to < 4.6.2.667affected
  • 4.6.3 to < 4.6.3.36affected
  • 4.6.4 to < 4.6.4.14affected
  • 4.7.1 to < 4.7.1.68affected
  • 4.8.1 to < 4.8.1.39affected
  • 4.9.0 to < 4.9.0.99affected
  • 4.9.26 to < 4.9.26.25affected
  • 4.9.27 to < 4.9.27.10affected
  • 4.9.28 to < 4.9.28.11affected
  • 4.10.9 to < 4.10.9.66affected
  • 4.10.42 to < 4.10.42.9affected
  • 4.9 to < 4.9.29affected
  • 4.10 to < 4.10.94affected

WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt

Default version status: unknown

  • 5.2.0 to < 5.2.0.4affected
  • 5.2.2 to < 5.2.2.21affected
  • 5.7.5 to < 5.7.5.18affected
  • 5.11.148 to < 5.11.148.19affected
  • 5.11.256 to < 5.11.256.21affected
  • 5.12.153 to < 5.12.153.63affected
  • 5.12.387 to < 5.12.387.46affected
  • 5.14.97 to < 5.14.97.89affected
  • 5.17.5 to < 5.17.5.317affected
  • 5.17.118 to < 5.17.118.17affected
  • 5.18.187 to < 5.18.187.309affected
  • 5.18.248 to < 5.18.248.30affected
  • 5.23.8 to < 5.23.8.207affected
  • 5.24.8 to < 5.24.8.23affected
  • 5.25.92 to < 5.25.92.152affected
  • 5.25.705 to < 5.25.705.19affected
  • 5.25.713 to < 5.25.713.9affected
  • 5.25.724 to < 5.25.724.3affected
  • 7.0.78 to < 7.0.78.133affected
  • 7.8.23 to < 7.8.23.47affected
  • 5.25 to < 5.25.734affected
  • 7.8.489 to ≤ *unaffected

WSO2 org.wso2.carbon:org.wso2.carbon.server.admin

Default version status: unknown

  • 4.4.7 to < 4.4.7.6affected
  • 4.4.9 to < 4.4.9.11affected
  • 4.4.11 to < 4.4.11.9affected
  • 4.4.26 to < 4.4.26.12affected
  • 4.4.32 to < 4.4.32.16affected
  • 4.4.35 to < 4.4.35.44affected
  • 4.5.1 to < 4.5.1.43affected
  • 4.6.0 to < 4.6.0.1990affected
  • 4.6.1 to < 4.6.1.149affected
  • 4.6.2 to < 4.6.2.667affected
  • 4.6.3 to < 4.6.3.36affected
  • 4.6.4 to < 4.6.4.14affected
  • 4.7.1 to < 4.7.1.68affected
  • 4.8.1 to < 4.8.1.39affected
  • 4.9.0 to < 4.9.0.99affected
  • 4.9.26 to < 4.9.26.25affected
  • 4.9.27 to < 4.9.27.10affected
  • 4.9.28 to < 4.9.28.11affected
  • 4.10.9 to < 4.10.9.66affected
  • 4.10.42 to < 4.10.42.9affected
  • 4.9 to < 4.9.29affected
  • 4.10 to < 4.10.94affected

WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow

Default version status: unknown

  • 5.1.1 to < 5.1.1.1affected
  • 5.1.2 to < 5.1.2.1affected
  • 5.1.5 to < 5.1.5.1affected
  • 5.3.3 to < 5.3.3.1affected
  • 5.4.0 to < 5.4.0.4affected
  • 5.4.1 to < 5.4.1.5affected
  • 5.6.0 to < 5.6.0.1affected
  • 5.6.21 to ≤ *unaffected

References