CVE-2024-7097 json
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
published 2025-05-30 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16505
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.
Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Patch / fix
- WSO2 WSO2 Open Banking AM 1.3.0.131, 1.4.0.134, 1.5.0.136, 2.0.0.343
- WSO2 WSO2 Open Banking KM 1.3.0.114, 1.4.0.130, 1.5.0.120
- WSO2 WSO2 Identity Server as Key Manager 5.3.0.38, 5.5.0.51, 5.6.0.72, 5.7.0.122, 5.9.0.165, 5.10.0.312
- WSO2 WSO2 API Manager 2.0.0.29, 2.1.0.39, 2.2.0.56, 2.5.0.83, 2.6.0.142, 3.0.0.162, 3.1.0.294, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.101, 4.3.0.16
- WSO2 WSO2 Identity Server 5.2.0.32, 5.3.0.33, 5.4.0.32, 5.4.1.36, 5.5.0.50, 5.6.0.58, 5.7.0.123, 5.8.0.106, 5.9.0.157, 5.10.0.318, 5.11.0.365, 6.0.0.209, 6.1.0.188, 7.0.0.60
- WSO2 WSO2 Open Banking IAM 2.0.0.364
- WSO2 WSO2 Enterprise Mobility Manager 2.2.0.26
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template WSO2 User Registration - Arbitrary Account Creation nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- WSO2 WSO2 Open Banking AM
- WSO2 WSO2 Open Banking KM
- WSO2 WSO2 Identity Server as Key Manager
- WSO2 WSO2 API Manager
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Open Banking IAM
- WSO2 WSO2 Enterprise Mobility Manager
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
Sources
- CVE List CVE-2024-7097
- NVD CVE-2024-7097
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.