{"id":"CVE-2025-9804","state":"PUBLISHED","title":"Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs","description":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.","publishedAt":"2025-10-16T12:33:45.426Z","updatedAt":"2025-10-17T16:01:25.350Z","severity":{"score":9.6,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 Identity Server as Key Manager","WSO2 WSO2 Identity Server","WSO2 WSO2 Open Banking KM","WSO2 WSO2 Open Banking IAM","WSO2 WSO2 Open Banking AM","WSO2 WSO2 API Manager","WSO2 WSO2 Identity Server Analytics","WSO2 API Manager Analytics","WSO2 WSO2 Enterprise Integrator","WSO2 WSO2 Enterprise Service Bus Analytics","WSO2 WSO2 Data Analytics Server","WSO2 WSO2 Enterprise Mobility Manager","WSO2 WSO2 Universal Gateway","WSO2 WSO2 API Control Plane","WSO2 WSO2 Traffic Manager","WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","WSO2 org.wso2.carbon:org.wso2.carbon.base","WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","WSO2 org.wso2.carbon:org.wso2.carbon.server.admin","WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow"],"affected":[{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.41","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.53","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.75","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.125","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.176","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.359","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.34","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.36","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.34","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.52","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.60","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.126","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.110","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.169","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.369","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.413","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.244","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.243","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.118","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.0.25","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.133","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.123","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.409","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.139","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.140","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.389","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.31","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.40","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.59","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.85","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.146","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.176","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.340","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.441","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.61","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.361","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.224","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.162","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.75","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.39","versionType":"custom"},{"version":"4.5.0","status":"affected","lessThan":"4.5.0.23","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.19","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.17","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.31","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.38","versionType":"custom"}]},{"vendor":"WSO2","product":"API Manager Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.14","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.19","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.30","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.39","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Integrator","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"6.2.0","versionType":"custom"},{"version":"6.2.0","status":"affected","lessThan":"6.2.0.62","versionType":"custom"},{"version":"6.3.0","status":"affected","lessThan":"6.3.0.70","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Service Bus Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.0.0","versionType":"custom"},{"version":"5.0.0","status":"affected","lessThan":"5.0.0.13","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Data Analytics Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.1.0","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.20","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.33","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.28","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.22","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.24","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.22","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","packageName":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","defaultStatus":"unknown","versions":[{"version":"2.0.10","status":"affected","lessThan":"2.0.10.1","versionType":"custom"},{"version":"2.0.15","status":"affected","lessThan":"2.0.15.1","versionType":"custom"},{"version":"2.0.21","status":"affected","lessThan":"2.0.21.1","versionType":"custom"},{"version":"2.0.22","status":"affected","lessThan":"2.0.22.1","versionType":"custom"},{"version":"2.1.12","status":"affected","lessThan":"2.1.12.1","versionType":"custom"},{"version":"2.1","status":"affected","lessThan":"2.1.1972","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.24","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.25","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.74","versionType":"custom"},{"version":"3.3.6","status":"affected","lessThan":"3.3.6.7","versionType":"custom"},{"version":"3.3.26","status":"affected","lessThan":"3.3.26.2","versionType":"custom"},{"version":"3.3.35","status":"affected","lessThan":"3.3.35.1","versionType":"custom"},{"version":"3.3.41","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","defaultStatus":"unknown","versions":[{"version":"6.7.206","status":"affected","lessThan":"6.7.206.567","versionType":"custom"},{"version":"6.7.210","status":"affected","lessThan":"6.7.210.63","versionType":"custom"},{"version":"9.0.174","status":"affected","lessThan":"9.0.174.522","versionType":"custom"},{"version":"9.20.74","status":"affected","lessThan":"9.20.74.379","versionType":"custom"},{"version":"9.28.116","status":"affected","lessThan":"9.28.116.360","versionType":"custom"},{"version":"9.29.120","status":"affected","lessThan":"9.29.120.184","versionType":"custom"},{"version":"9.30.67","status":"affected","lessThan":"9.30.67.109","versionType":"custom"},{"version":"9.31.86","status":"affected","lessThan":"9.31.86.71","versionType":"custom"},{"version":"9.32.133","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","packageName":"org.wso2.carbon:org.wso2.carbon.base","defaultStatus":"unknown","versions":[{"version":"4.4.7","status":"affected","lessThan":"4.4.7.6","versionType":"custom"},{"version":"4.4.9","status":"affected","lessThan":"4.4.9.11","versionType":"custom"},{"version":"4.4.11","status":"affected","lessThan":"4.4.11.9","versionType":"custom"},{"version":"4.4.26","status":"affected","lessThan":"4.4.26.12","versionType":"custom"},{"version":"4.4.35","status":"affected","lessThan":"4.4.35.44","versionType":"custom"},{"version":"4.5.1","status":"affected","lessThan":"4.5.1.43","versionType":"custom"},{"version":"4.6.0","status":"affected","lessThan":"4.6.0.1990","versionType":"custom"},{"version":"4.6.1","status":"affected","lessThan":"4.6.1.149","versionType":"custom"},{"version":"4.6.2","status":"affected","lessThan":"4.6.2.667","versionType":"custom"},{"version":"4.6.3","status":"affected","lessThan":"4.6.3.36","versionType":"custom"},{"version":"4.6.4","status":"affected","lessThan":"4.6.4.14","versionType":"custom"},{"version":"4.7.1","status":"affected","lessThan":"4.7.1.68","versionType":"custom"},{"version":"4.8.1","status":"affected","lessThan":"4.8.1.39","versionType":"custom"},{"version":"4.9.0","status":"affected","lessThan":"4.9.0.99","versionType":"custom"},{"version":"4.9.26","status":"affected","lessThan":"4.9.26.25","versionType":"custom"},{"version":"4.9.27","status":"affected","lessThan":"4.9.27.10","versionType":"custom"},{"version":"4.9.28","status":"affected","lessThan":"4.9.28.11","versionType":"custom"},{"version":"4.10.9","status":"affected","lessThan":"4.10.9.66","versionType":"custom"},{"version":"4.10.42","status":"affected","lessThan":"4.10.42.9","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.29","versionType":"custom"},{"version":"4.10","status":"affected","lessThan":"4.10.94","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","defaultStatus":"unknown","versions":[{"version":"5.2.0","status":"affected","lessThan":"5.2.0.4","versionType":"custom"},{"version":"5.2.2","status":"affected","lessThan":"5.2.2.21","versionType":"custom"},{"version":"5.7.5","status":"affected","lessThan":"5.7.5.18","versionType":"custom"},{"version":"5.11.148","status":"affected","lessThan":"5.11.148.19","versionType":"custom"},{"version":"5.11.256","status":"affected","lessThan":"5.11.256.21","versionType":"custom"},{"version":"5.12.153","status":"affected","lessThan":"5.12.153.63","versionType":"custom"},{"version":"5.12.387","status":"affected","lessThan":"5.12.387.46","versionType":"custom"},{"version":"5.14.97","status":"affected","lessThan":"5.14.97.89","versionType":"custom"},{"version":"5.17.5","status":"affected","lessThan":"5.17.5.317","versionType":"custom"},{"version":"5.17.118","status":"affected","lessThan":"5.17.118.17","versionType":"custom"},{"version":"5.18.187","status":"affected","lessThan":"5.18.187.309","versionType":"custom"},{"version":"5.18.248","status":"affected","lessThan":"5.18.248.30","versionType":"custom"},{"version":"5.23.8","status":"affected","lessThan":"5.23.8.207","versionType":"custom"},{"version":"5.24.8","status":"affected","lessThan":"5.24.8.23","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.152","versionType":"custom"},{"version":"5.25.705","status":"affected","lessThan":"5.25.705.19","versionType":"custom"},{"version":"5.25.713","status":"affected","lessThan":"5.25.713.9","versionType":"custom"},{"version":"5.25.724","status":"affected","lessThan":"5.25.724.3","versionType":"custom"},{"version":"7.0.78","status":"affected","lessThan":"7.0.78.133","versionType":"custom"},{"version":"7.8.23","status":"affected","lessThan":"7.8.23.47","versionType":"custom"},{"version":"5.25","status":"affected","lessThan":"5.25.734","versionType":"custom"},{"version":"7.8.489","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","packageName":"org.wso2.carbon:org.wso2.carbon.server.admin","defaultStatus":"unknown","versions":[{"version":"4.4.7","status":"affected","lessThan":"4.4.7.6","versionType":"custom"},{"version":"4.4.9","status":"affected","lessThan":"4.4.9.11","versionType":"custom"},{"version":"4.4.11","status":"affected","lessThan":"4.4.11.9","versionType":"custom"},{"version":"4.4.26","status":"affected","lessThan":"4.4.26.12","versionType":"custom"},{"version":"4.4.32","status":"affected","lessThan":"4.4.32.16","versionType":"custom"},{"version":"4.4.35","status":"affected","lessThan":"4.4.35.44","versionType":"custom"},{"version":"4.5.1","status":"affected","lessThan":"4.5.1.43","versionType":"custom"},{"version":"4.6.0","status":"affected","lessThan":"4.6.0.1990","versionType":"custom"},{"version":"4.6.1","status":"affected","lessThan":"4.6.1.149","versionType":"custom"},{"version":"4.6.2","status":"affected","lessThan":"4.6.2.667","versionType":"custom"},{"version":"4.6.3","status":"affected","lessThan":"4.6.3.36","versionType":"custom"},{"version":"4.6.4","status":"affected","lessThan":"4.6.4.14","versionType":"custom"},{"version":"4.7.1","status":"affected","lessThan":"4.7.1.68","versionType":"custom"},{"version":"4.8.1","status":"affected","lessThan":"4.8.1.39","versionType":"custom"},{"version":"4.9.0","status":"affected","lessThan":"4.9.0.99","versionType":"custom"},{"version":"4.9.26","status":"affected","lessThan":"4.9.26.25","versionType":"custom"},{"version":"4.9.27","status":"affected","lessThan":"4.9.27.10","versionType":"custom"},{"version":"4.9.28","status":"affected","lessThan":"4.9.28.11","versionType":"custom"},{"version":"4.10.9","status":"affected","lessThan":"4.10.9.66","versionType":"custom"},{"version":"4.10.42","status":"affected","lessThan":"4.10.42.9","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.29","versionType":"custom"},{"version":"4.10","status":"affected","lessThan":"4.10.94","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","packageName":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","defaultStatus":"unknown","versions":[{"version":"5.1.1","status":"affected","lessThan":"5.1.1.1","versionType":"custom"},{"version":"5.1.2","status":"affected","lessThan":"5.1.2.1","versionType":"custom"},{"version":"5.1.5","status":"affected","lessThan":"5.1.5.1","versionType":"custom"},{"version":"5.3.3","status":"affected","lessThan":"5.3.3.1","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.4","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.5","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.6.21","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9804.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9804","state":"PUBLISHED","datePublished":"2025-10-16T12:33:45.426Z","dateUpdated":"2025-10-17T16:01:25.350Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2025-09-01T13:11:12.678Z"},"containers":{"cna":{"title":"Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs","descriptions":[{"lang":"en","value":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected."}],"affected":[{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.3.0","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.41","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.53","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.75","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.125","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.176","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.359","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.34","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.36","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.34","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.38","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.52","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.60","versionType":"custom"},{"version":"5.7.0","status":"affected","lessThan":"5.7.0.126","versionType":"custom"},{"version":"5.8.0","status":"affected","lessThan":"5.8.0.110","versionType":"custom"},{"version":"5.9.0","status":"affected","lessThan":"5.9.0.169","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.369","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.413","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.244","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.243","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.118","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.0.25","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking KM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.133","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.123","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.409","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"1.4.0","versionType":"custom"},{"version":"1.4.0","status":"affected","lessThan":"1.4.0.139","versionType":"custom"},{"version":"1.5.0","status":"affected","lessThan":"1.5.0.140","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.389","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.31","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.40","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.59","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.85","versionType":"custom"},{"version":"2.6.0","status":"affected","lessThan":"2.6.0.146","versionType":"custom"},{"version":"3.0.0","status":"affected","lessThan":"3.0.0.176","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.340","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.441","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.61","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.361","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.224","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.162","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.75","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.39","versionType":"custom"},{"version":"4.5.0","status":"affected","lessThan":"4.5.0.23","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.2.0","versionType":"custom"},{"version":"5.2.0","status":"affected","lessThan":"5.2.0.19","versionType":"custom"},{"version":"5.3.0","status":"affected","lessThan":"5.3.0.17","versionType":"custom"},{"version":"5.5.0","status":"affected","lessThan":"5.5.0.31","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.38","versionType":"custom"}]},{"vendor":"WSO2","product":"API Manager Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.14","versionType":"custom"},{"version":"2.1.0","status":"affected","lessThan":"2.1.0.19","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.30","versionType":"custom"},{"version":"2.5.0","status":"affected","lessThan":"2.5.0.39","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Integrator","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"6.2.0","versionType":"custom"},{"version":"6.2.0","status":"affected","lessThan":"6.2.0.62","versionType":"custom"},{"version":"6.3.0","status":"affected","lessThan":"6.3.0.70","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Service Bus Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.0.0","versionType":"custom"},{"version":"5.0.0","status":"affected","lessThan":"5.0.0.13","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Data Analytics Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.1.0","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.20","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.33","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0","versionType":"custom"},{"version":"2.2.0","status":"affected","lessThan":"2.2.0.28","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.22","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.24","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"4.5.0","status":"affected","lessThan":"4.5.0.22","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","packageName":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","defaultStatus":"unknown","versions":[{"version":"2.0.10","status":"affected","lessThan":"2.0.10.1","versionType":"custom"},{"version":"2.0.15","status":"affected","lessThan":"2.0.15.1","versionType":"custom"},{"version":"2.0.21","status":"affected","lessThan":"2.0.21.1","versionType":"custom"},{"version":"2.0.22","status":"affected","lessThan":"2.0.22.1","versionType":"custom"},{"version":"2.1.12","status":"affected","lessThan":"2.1.12.1","versionType":"custom"},{"version":"2.1","status":"affected","lessThan":"2.1.1972","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.24","versionType":"custom"},{"version":"2.2","status":"affected","lessThan":"2.2.25","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.74","versionType":"custom"},{"version":"3.3.6","status":"affected","lessThan":"3.3.6.7","versionType":"custom"},{"version":"3.3.26","status":"affected","lessThan":"3.3.26.2","versionType":"custom"},{"version":"3.3.35","status":"affected","lessThan":"3.3.35.1","versionType":"custom"},{"version":"3.3.41","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","defaultStatus":"unknown","versions":[{"version":"6.7.206","status":"affected","lessThan":"6.7.206.567","versionType":"custom"},{"version":"6.7.210","status":"affected","lessThan":"6.7.210.63","versionType":"custom"},{"version":"9.0.174","status":"affected","lessThan":"9.0.174.522","versionType":"custom"},{"version":"9.20.74","status":"affected","lessThan":"9.20.74.379","versionType":"custom"},{"version":"9.28.116","status":"affected","lessThan":"9.28.116.360","versionType":"custom"},{"version":"9.29.120","status":"affected","lessThan":"9.29.120.184","versionType":"custom"},{"version":"9.30.67","status":"affected","lessThan":"9.30.67.109","versionType":"custom"},{"version":"9.31.86","status":"affected","lessThan":"9.31.86.71","versionType":"custom"},{"version":"9.32.133","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","packageName":"org.wso2.carbon:org.wso2.carbon.base","defaultStatus":"unknown","versions":[{"version":"4.4.7","status":"affected","lessThan":"4.4.7.6","versionType":"custom"},{"version":"4.4.9","status":"affected","lessThan":"4.4.9.11","versionType":"custom"},{"version":"4.4.11","status":"affected","lessThan":"4.4.11.9","versionType":"custom"},{"version":"4.4.26","status":"affected","lessThan":"4.4.26.12","versionType":"custom"},{"version":"4.4.35","status":"affected","lessThan":"4.4.35.44","versionType":"custom"},{"version":"4.5.1","status":"affected","lessThan":"4.5.1.43","versionType":"custom"},{"version":"4.6.0","status":"affected","lessThan":"4.6.0.1990","versionType":"custom"},{"version":"4.6.1","status":"affected","lessThan":"4.6.1.149","versionType":"custom"},{"version":"4.6.2","status":"affected","lessThan":"4.6.2.667","versionType":"custom"},{"version":"4.6.3","status":"affected","lessThan":"4.6.3.36","versionType":"custom"},{"version":"4.6.4","status":"affected","lessThan":"4.6.4.14","versionType":"custom"},{"version":"4.7.1","status":"affected","lessThan":"4.7.1.68","versionType":"custom"},{"version":"4.8.1","status":"affected","lessThan":"4.8.1.39","versionType":"custom"},{"version":"4.9.0","status":"affected","lessThan":"4.9.0.99","versionType":"custom"},{"version":"4.9.26","status":"affected","lessThan":"4.9.26.25","versionType":"custom"},{"version":"4.9.27","status":"affected","lessThan":"4.9.27.10","versionType":"custom"},{"version":"4.9.28","status":"affected","lessThan":"4.9.28.11","versionType":"custom"},{"version":"4.10.9","status":"affected","lessThan":"4.10.9.66","versionType":"custom"},{"version":"4.10.42","status":"affected","lessThan":"4.10.42.9","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.29","versionType":"custom"},{"version":"4.10","status":"affected","lessThan":"4.10.94","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","defaultStatus":"unknown","versions":[{"version":"5.2.0","status":"affected","lessThan":"5.2.0.4","versionType":"custom"},{"version":"5.2.2","status":"affected","lessThan":"5.2.2.21","versionType":"custom"},{"version":"5.7.5","status":"affected","lessThan":"5.7.5.18","versionType":"custom"},{"version":"5.11.148","status":"affected","lessThan":"5.11.148.19","versionType":"custom"},{"version":"5.11.256","status":"affected","lessThan":"5.11.256.21","versionType":"custom"},{"version":"5.12.153","status":"affected","lessThan":"5.12.153.63","versionType":"custom"},{"version":"5.12.387","status":"affected","lessThan":"5.12.387.46","versionType":"custom"},{"version":"5.14.97","status":"affected","lessThan":"5.14.97.89","versionType":"custom"},{"version":"5.17.5","status":"affected","lessThan":"5.17.5.317","versionType":"custom"},{"version":"5.17.118","status":"affected","lessThan":"5.17.118.17","versionType":"custom"},{"version":"5.18.187","status":"affected","lessThan":"5.18.187.309","versionType":"custom"},{"version":"5.18.248","status":"affected","lessThan":"5.18.248.30","versionType":"custom"},{"version":"5.23.8","status":"affected","lessThan":"5.23.8.207","versionType":"custom"},{"version":"5.24.8","status":"affected","lessThan":"5.24.8.23","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.152","versionType":"custom"},{"version":"5.25.705","status":"affected","lessThan":"5.25.705.19","versionType":"custom"},{"version":"5.25.713","status":"affected","lessThan":"5.25.713.9","versionType":"custom"},{"version":"5.25.724","status":"affected","lessThan":"5.25.724.3","versionType":"custom"},{"version":"7.0.78","status":"affected","lessThan":"7.0.78.133","versionType":"custom"},{"version":"7.8.23","status":"affected","lessThan":"7.8.23.47","versionType":"custom"},{"version":"5.25","status":"affected","lessThan":"5.25.734","versionType":"custom"},{"version":"7.8.489","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","packageName":"org.wso2.carbon:org.wso2.carbon.server.admin","defaultStatus":"unknown","versions":[{"version":"4.4.7","status":"affected","lessThan":"4.4.7.6","versionType":"custom"},{"version":"4.4.9","status":"affected","lessThan":"4.4.9.11","versionType":"custom"},{"version":"4.4.11","status":"affected","lessThan":"4.4.11.9","versionType":"custom"},{"version":"4.4.26","status":"affected","lessThan":"4.4.26.12","versionType":"custom"},{"version":"4.4.32","status":"affected","lessThan":"4.4.32.16","versionType":"custom"},{"version":"4.4.35","status":"affected","lessThan":"4.4.35.44","versionType":"custom"},{"version":"4.5.1","status":"affected","lessThan":"4.5.1.43","versionType":"custom"},{"version":"4.6.0","status":"affected","lessThan":"4.6.0.1990","versionType":"custom"},{"version":"4.6.1","status":"affected","lessThan":"4.6.1.149","versionType":"custom"},{"version":"4.6.2","status":"affected","lessThan":"4.6.2.667","versionType":"custom"},{"version":"4.6.3","status":"affected","lessThan":"4.6.3.36","versionType":"custom"},{"version":"4.6.4","status":"affected","lessThan":"4.6.4.14","versionType":"custom"},{"version":"4.7.1","status":"affected","lessThan":"4.7.1.68","versionType":"custom"},{"version":"4.8.1","status":"affected","lessThan":"4.8.1.39","versionType":"custom"},{"version":"4.9.0","status":"affected","lessThan":"4.9.0.99","versionType":"custom"},{"version":"4.9.26","status":"affected","lessThan":"4.9.26.25","versionType":"custom"},{"version":"4.9.27","status":"affected","lessThan":"4.9.27.10","versionType":"custom"},{"version":"4.9.28","status":"affected","lessThan":"4.9.28.11","versionType":"custom"},{"version":"4.10.9","status":"affected","lessThan":"4.10.9.66","versionType":"custom"},{"version":"4.10.42","status":"affected","lessThan":"4.10.42.9","versionType":"custom"},{"version":"4.9","status":"affected","lessThan":"4.9.29","versionType":"custom"},{"version":"4.10","status":"affected","lessThan":"4.10.94","versionType":"custom"}]},{"vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","packageName":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","defaultStatus":"unknown","versions":[{"version":"5.1.1","status":"affected","lessThan":"5.1.1.1","versionType":"custom"},{"version":"5.1.2","status":"affected","lessThan":"5.1.2.1","versionType":"custom"},{"version":"5.1.5","status":"affected","lessThan":"5.1.5.1","versionType":"custom"},{"version":"5.3.3","status":"affected","lessThan":"5.3.3.1","versionType":"custom"},{"version":"5.4.0","status":"affected","lessThan":"5.4.0.4","versionType":"custom"},{"version":"5.4.1","status":"affected","lessThan":"5.4.1.5","versionType":"custom"},{"version":"5.6.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.6.21","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"For WSO2 API Manager"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"For WSO2 Identity Server"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2025-10-16T12:33:45.426Z"},"credits":[{"lang":"en","type":"reporter","value":"crnković"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution</span></a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"}],"source":{"advisory":"WSO2-2025-4503","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-16T13:20:20.582589Z","id":"CVE-2025-9804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-17T16:01:25.350Z"}}]}}}