Vulnerability · Published May 30, 2025 · Assigned by WSO2
CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
Medium 4.2
In plain English
A medium-severity incorrect authorization in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wso2.am:am-parent | 4.4.0 | GHSA-j63j-7r7r-5v4j |
| Maven | org.wso2.is:identity-server-parent | 7.1.0 | GHSA-j63j-7r7r-5v4j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – before 2.0.0.364 |
| WSO2 | WSO2 Open Banking AM | 1.3.0 – before 1.3.0.1311.4.0 – before 1.4.0.1341.5.0 – before 1.5.0.1362.0.0 – before 2.0.0.343 |
| WSO2 | WSO2 API Manager | 2.0.0 – before 2.0.0.292.1.0 – before 2.1.0.392.2.0 – before 2.2.0.562.5.0 – before 2.5.0.832.6.0 – before 2.6.0.1423.0.0 – before 3.0.0.1623.1.0 – before 3.1.0.294 |
| WSO2 | WSO2 Enterprise Mobility Manager | 2.2.0 – before 2.2.0.26 |
| WSO2 | WSO2 Identity Server | 5.2.0 – before 5.2.0.325.3.0 – before 5.3.0.335.4.1 – before 5.4.1.365.5.0 – before 5.5.0.505.6.0 – before 5.6.0.585.7.0 – before 5.7.0.1235.8.0 – before 5.8.0.106 |
| WSO2 | WSO2 Identity Server as Key Manager | 5.3.0 – before 5.3.0.385.5.0 – before 5.5.0.515.6.0 – before 5.6.0.725.7.0 – before 5.7.0.1225.9.0 – before 5.9.0.1655.10.0 – before 5.10.0.312 |
| WSO2 | WSO2 Open Banking KM | 1.3.0 – before 1.3.0.1141.4.0 – before 1.4.0.1301.5.0 – before 1.5.0.120 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N