Skip to content
Fencer Vulns
critical 9.6

CVE-2025-9804 json

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

published 2025-10-16 12 mo ago modified 2026-09-26 44 d ago also EUVD-2025-34754

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Patch / fix

  • WSO2 WSO2 Identity Server as Key Manager 5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176, 5.10.0.359
  • WSO2 WSO2 Identity Server 5.2.0.34, 5.3.0.36, 5.4.0.34, 5.4.1.38, 5.5.0.52, 5.6.0.60, 5.7.0.126, 5.8.0.110, 5.9.0.169, 5.10.0.369, 5.11.0.413, 6.0.0.244, 6.1.0.243, 7.0.0.118, 7.1.0.25
  • WSO2 WSO2 Open Banking KM 1.4.0.133, 1.5.0.123
  • WSO2 WSO2 Open Banking IAM 2.0.0.409
  • WSO2 WSO2 Open Banking AM 1.4.0.139, 1.5.0.140, 2.0.0.389
  • WSO2 WSO2 API Manager 2.0.0.31, 2.1.0.40, 2.2.0.59, 2.5.0.85, 2.6.0.146, 3.0.0.176, 3.1.0.340, 3.2.0.441, 3.2.1.61, 4.0.0.361, 4.1.0.224, 4.2.0.162, 4.3.0.75, 4.4.0.39, 4.5.0.23
  • WSO2 WSO2 Identity Server Analytics 5.2.0.19, 5.3.0.17, 5.5.0.31, 5.6.0.38
  • WSO2 API Manager Analytics 2.0.0.14, 2.1.0.19, 2.2.0.30, 2.5.0.39
  • WSO2 WSO2 Enterprise Integrator 6.2.0.62, 6.3.0.70
  • WSO2 WSO2 Enterprise Service Bus Analytics 5.0.0.13
  • WSO2 WSO2 Data Analytics Server 3.1.0.20, 3.2.0.33
  • WSO2 WSO2 Enterprise Mobility Manager 2.2.0.28
  • WSO2 WSO2 Universal Gateway 4.5.0.22
  • WSO2 WSO2 API Control Plane 4.5.0.24
  • WSO2 WSO2 Traffic Manager 4.5.0.22
  • WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.10.1, 2.0.15.1, 2.0.21.1, 2.0.22.1, 2.1.12.1, 2.1.1972, 2.2.24, 2.2.25, 3.1.0.74, 3.3.6.7, 3.3.26.2, 3.3.35.1, 3.3.41
  • WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 6.7.206.567, 6.7.210.63, 9.0.174.522, 9.20.74.379, 9.28.116.360, 9.29.120.184, 9.30.67.109, 9.31.86.71, 9.32.133
  • WSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.9.29, 4.10.9.66, 4.10.42.9
  • WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.2.0.4, 5.2.2.21, 5.7.5.18, 5.11.148.19, 5.11.256.21, 5.12.153.63, 5.12.387.46, 5.14.97.89, 5.17.5.317, 5.17.118.17, 5.18.187.309, 5.18.248.30, 5.23.8.207, 5.24.8.23, 5.25.92.152, 5.25.705.19, 5.25.713.9, 5.25.724.3, 7.0.78.133, 7.8.23.47
  • WSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.32.16, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9
  • WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.1.1.1, 5.1.2.1, 5.1.5.1, 5.3.3.1, 5.4.0.4, 5.4.1.5, 5.6.0.1, 5.6.21

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • WSO2 WSO2 Identity Server as Key Manager
  • WSO2 WSO2 Identity Server
  • WSO2 WSO2 Open Banking KM
  • WSO2 WSO2 Open Banking IAM
  • WSO2 WSO2 Open Banking AM
  • WSO2 WSO2 API Manager
  • WSO2 WSO2 Identity Server Analytics
  • WSO2 API Manager Analytics
  • WSO2 WSO2 Enterprise Integrator
  • WSO2 WSO2 Enterprise Service Bus Analytics
  • WSO2 WSO2 Data Analytics Server
  • WSO2 WSO2 Enterprise Mobility Manager
  • WSO2 WSO2 Universal Gateway
  • WSO2 WSO2 API Control Plane
  • WSO2 WSO2 Traffic Manager
  • WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector
  • WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
  • WSO2 org.wso2.carbon:org.wso2.carbon.base
  • WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt
  • WSO2 org.wso2.carbon:org.wso2.carbon.server.admin
  • WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.