CVE-2025-9804

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Score

CVSS 3.1 9.6 Critical

Status

Analyzed - ed10eef1-636d-4fbe-9993-6890dfa878f8

Published

2025-10-16

Last modified

2025-10-17

Weaknesses

CWE-284

Affected products

• Api Control Plane (Wso2)
• Api Manager (Wso2)
• Api Manager Analytics (Wso2)
• Data Analytics Server (Wso2)
• Enterprise Integrator (Wso2)
• Enterprise Mobility Manager (Wso2)
• Enterprise Service Bus (Wso2)
• Identity Server (Wso2)
• Identity Server Analytics (Wso2)
• Identity Server As Key Manager (Wso2)
• Open Banking Am (Wso2)
• Open Banking Iam (Wso2)
• Open Banking Km (Wso2)
• Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util (Wso2)
• Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector (Wso2)
• Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt (Wso2)
• Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow (Wso2)
• Org.wso2.carbonorg.wso2.carbon.base (Wso2)
• Org.wso2.carbonorg.wso2.carbon.server.admin (Wso2)
• Traffic Manager (Wso2)
• Universal Gateway (Wso2)
• Wso2 Api Control Plane (Wso2)
• Wso2 Api Manager (Wso2)
• Wso2 Data Analytics Server (Wso2)
• Wso2 Enterprise Integrator (Wso2)
• Wso2 Enterprise Mobility Manager (Wso2)
• Wso2 Enterprise Service Bus Analytics (Wso2)
• Wso2 Identity Server (Wso2)
• Wso2 Identity Server Analytics (Wso2)
• Wso2 Identity Server As Key Manager (Wso2)
• Wso2 Open Banking Am (Wso2)
• Wso2 Open Banking Iam (Wso2)
• Wso2 Open Banking Km (Wso2)
• Wso2 Traffic Manager (Wso2)
• Wso2 Universal Gateway (Wso2)

References

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/