GHSA-j63j-7r7r-5v4j WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services

• Maven org.wso2.am:am-parent: >= 2.0.0, < 4.4.0 → fixed in 4.4.0 • Maven org.wso2.is:identity-server-parent: >= 5.2.0, < 7.1.0 → fixed in 7.1.0

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: • SOAP admin services are accessible to the attacker. • The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. • At least one custom role exists with non-default permissions. • The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.