CVEvulnerability

CVE-2025-9804

6.5 MEDIUM Published 2025-10-16 Modified 2026-09-26 Official page ↗
Status
Analyzed
Published
2025-10-16
Last modified
2026-09-26
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
9.6 CRITICAL — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Affected configurations

• wso2 api control plane 4.5.0 • wso2 api manager 2.0.0 • wso2 api manager 2.1.0 • wso2 api manager 2.2.0 • wso2 api manager 2.5.0 • wso2 api manager 2.6.0 • wso2 api manager 3.0.0 • wso2 api manager 3.1.0 • wso2 api manager 3.2.0 • wso2 api manager 3.2.1 • wso2 api manager 4.0.0 • wso2 api manager 4.1.0 • wso2 api manager 4.2.0 • wso2 api manager 4.3.0 • wso2 api manager 4.4.0 • wso2 api manager 4.5.0 • wso2 api manager analytics 2.0.0 • wso2 api manager analytics 2.1.0 • wso2 api manager analytics 2.2.0 • wso2 api manager analytics 2.5.0 • wso2 data analytics server 3.1.0 • wso2 data analytics server 3.2.0 • wso2 enterprise integrator 6.2.0 • wso2 enterprise integrator 6.3.0 • wso2 enterprise mobility manager 2.2.0 • wso2 enterprise service bus 5.0.0 • wso2 identity server 5.2.0 • wso2 identity server 5.3.0 • wso2 identity server 5.4.0 • wso2 identity server 5.4.1 • wso2 identity server 5.5.0 • wso2 identity server 5.6.0 • wso2 identity server 5.7.0 • wso2 identity server 5.8.0 • wso2 identity server 5.9.0 • wso2 identity server 5.10.0 • wso2 identity server 5.11.0 • wso2 identity server 6.0.0 • wso2 identity server 6.1.0 • wso2 identity server 7.0.0 • wso2 identity server 7.1.0 • wso2 identity server analytics 5.2.0 • wso2 identity server analytics 5.3.0 • wso2 identity server analytics 5.5.0 • wso2 identity server analytics 5.6.0 • wso2 identity server as key manager 5.3.0 • wso2 identity server as key manager 5.5.0 • wso2 identity server as key manager 5.6.0 • wso2 identity server as key manager 5.7.0 • wso2 identity server as key manager 5.9.0 • wso2 identity server as key manager 5.10.0 • wso2 open banking am 1.4.0 • wso2 open banking am 1.5.0 • wso2 open banking am 2.0.0 • wso2 open banking iam 2.0.0 • wso2 open banking km 1.4.0 • wso2 open banking km 1.5.0 • wso2 traffic manager 4.5.0 • wso2 universal gateway 4.5.0

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References