Log in Start free

Vulnerability · Published Oct 16, 2025 · Assigned by WSO2

CVE-2025-9804Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

Critical 9.6

In plain English

A critical-severity improper access control in API Manager Analytics from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.6%top 52.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Affected products (as reported)

VendorProductVersions
WSO2 WSO2 Identity Server as Key Manager 5.3.0 – before 5.3.0.415.5.0 – before 5.5.0.535.6.0 – before 5.6.0.755.7.0 – before 5.7.0.1255.9.0 – before 5.9.0.1765.10.0 – before 5.10.0.359
WSO2 WSO2 Identity Server 5.2.0 – before 5.2.0.345.3.0 – before 5.3.0.365.4.0 – before 5.4.0.345.4.1 – before 5.4.1.385.5.0 – before 5.5.0.525.6.0 – before 5.6.0.605.7.0 – before 5.7.0.126
WSO2 WSO2 Open Banking KM 1.4.0 – before 1.4.0.1331.5.0 – before 1.5.0.123
WSO2 WSO2 Open Banking IAM 2.0.0 – before 2.0.0.409
WSO2 WSO2 Open Banking AM 1.4.0 – before 1.4.0.1391.5.0 – before 1.5.0.1402.0.0 – before 2.0.0.389
WSO2 WSO2 API Manager 2.0.0 – before 2.0.0.312.1.0 – before 2.1.0.402.2.0 – before 2.2.0.592.5.0 – before 2.5.0.852.6.0 – before 2.6.0.1463.0.0 – before 3.0.0.1763.1.0 – before 3.1.0.340
WSO2 WSO2 Identity Server Analytics 5.2.0 – before 5.2.0.195.3.0 – before 5.3.0.175.5.0 – before 5.5.0.315.6.0 – before 5.6.0.38
WSO2 API Manager Analytics 2.0.0 – before 2.0.0.142.1.0 – before 2.1.0.192.2.0 – before 2.2.0.302.5.0 – before 2.5.0.39
WSO2 WSO2 Enterprise Integrator 6.2.0 – before 6.2.0.626.3.0 – before 6.3.0.70
WSO2 WSO2 Enterprise Service Bus Analytics 5.0.0 – before 5.0.0.13
WSO2 WSO2 Data Analytics Server 3.1.0 – before 3.1.0.203.2.0 – before 3.2.0.33
WSO2 WSO2 Enterprise Mobility Manager 2.2.0 – before 2.2.0.28
WSO2 WSO2 Universal Gateway 4.5.0 – before 4.5.0.22
WSO2 WSO2 API Control Plane 4.5.0 – before 4.5.0.24
WSO2 WSO2 Traffic Manager 4.5.0 – before 4.5.0.22
WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.10 – before 2.0.10.12.0.15 – before 2.0.15.12.0.21 – before 2.0.21.12.0.22 – before 2.0.22.12.1.12 – before 2.1.12.12.1 – before 2.1.19722.2 – before 2.2.242.2 – before 2.2.25
WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 6.7.206 – before 6.7.206.5676.7.210 – before 6.7.210.639.0.174 – before 9.0.174.5229.20.74 – before 9.20.74.3799.28.116 – before 9.28.116.3609.29.120 – before 9.29.120.1849.30.67 – before 9.30.67.1099.31.86 – before 9.31.86.71
WSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.7 – before 4.4.7.64.4.9 – before 4.4.9.114.4.11 – before 4.4.11.94.4.26 – before 4.4.26.124.4.35 – before 4.4.35.444.5.1 – before 4.5.1.434.6.0 – before 4.6.0.19904.6.1 – before 4.6.1.149
WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.2.0 – before 5.2.0.45.2.2 – before 5.2.2.215.7.5 – before 5.7.5.185.11.148 – before 5.11.148.195.11.256 – before 5.11.256.215.12.153 – before 5.12.153.635.12.387 – before 5.12.387.465.14.97 – before 5.14.97.89
WSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.7 – before 4.4.7.64.4.9 – before 4.4.9.114.4.11 – before 4.4.11.94.4.26 – before 4.4.26.124.4.32 – before 4.4.32.164.4.35 – before 4.4.35.444.5.1 – before 4.5.1.434.6.0 – before 4.6.0.1990
WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.1.1 – before 5.1.1.15.1.2 – before 5.1.2.15.1.5 – before 5.1.5.15.3.3 – before 5.3.3.15.4.0 – before 5.4.0.45.4.1 – before 5.4.1.55.6.0 – before 5.6.0.1

Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References