01 Record
CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
CriticalPUBLISHEDCNA: WSO2
CNA base score9.6 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
02 Description
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.55% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 46.2% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-09-26.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2025-10-16 12:33Z1 YR AGO
- Last updated
- 2025-10-17 16:01Z1 YR AGO
- Reserved
- 2025-09-01
- Assigning CNA
- WSO2
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.6)
- CNA CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-284Improper Access ControlPillar
- Data version
- 5.1
- Document digest
- 0c216a81d795e0d7ad541a51355670b90c5891e4ce10e3755acd45e624fe06ea
05 Affected products
VendorProductVersionsPlatforms
WSO2WSO2 Identity Server as Key Manager5.3.0 to < 5.3.0.41, 5.5.0 to < 5.5.0.53, 5.6.0 to < 5.6.0.75, 5.7.0 to < 5.7.0.125, 5.9.0 to < 5.9.0.176, 5.10.0 to < 5.10.0.359—
WSO2WSO2 Identity Server5.2.0 to < 5.2.0.34, 5.3.0 to < 5.3.0.36, 5.4.0 to < 5.4.0.34, 5.4.1 to < 5.4.1.38, 5.5.0 to < 5.5.0.52, 5.6.0 to < 5.6.0.60, 5.7.0 to < 5.7.0.126, 5.8.0 to < 5.8.0.110, 5.9.0 to < 5.9.0.169, 5.10.0 to < 5.10.0.369, 5.11.0 to < 5.11.0.413, 6.0.0 to < 6.0.0.244, 6.1.0 to < 6.1.0.243, 7.0.0 to < 7.0.0.118, 7.1.0 to < 7.1.0.25—
WSO2WSO2 API Manager2.0.0 to < 2.0.0.31, 2.1.0 to < 2.1.0.40, 2.2.0 to < 2.2.0.59, 2.5.0 to < 2.5.0.85, 2.6.0 to < 2.6.0.146, 3.0.0 to < 3.0.0.176, 3.1.0 to < 3.1.0.340, 3.2.0 to < 3.2.0.441, 3.2.1 to < 3.2.1.61, 4.0.0 to < 4.0.0.361, 4.1.0 to < 4.1.0.224, 4.2.0 to < 4.2.0.162, 4.3.0 to < 4.3.0.75, 4.4.0 to < 4.4.0.39, 4.5.0 to < 4.5.0.23—
WSO2WSO2 Identity Server Analytics5.2.0 to < 5.2.0.19, 5.3.0 to < 5.3.0.17, 5.5.0 to < 5.5.0.31, 5.6.0 to < 5.6.0.38—
WSO2API Manager Analytics2.0.0 to < 2.0.0.14, 2.1.0 to < 2.1.0.19, 2.2.0 to < 2.2.0.30, 2.5.0 to < 2.5.0.39—
WSO2org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector2.0.10 to < 2.0.10.1, 2.0.15 to < 2.0.15.1, 2.0.21 to < 2.0.21.1, 2.0.22 to < 2.0.22.1, 2.1.12 to < 2.1.12.1, 2.1 to < 2.1.1972, 2.2 to < 2.2.24, 2.2 to < 2.2.25, 3.1.0 to < 3.1.0.74, 3.3.6 to < 3.3.6.7, 3.3.26 to < 3.3.26.2, 3.3.35 to < 3.3.35.1—
WSO2org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util6.7.206 to < 6.7.206.567, 6.7.210 to < 6.7.210.63, 9.0.174 to < 9.0.174.522, 9.20.74 to < 9.20.74.379, 9.28.116 to < 9.28.116.360, 9.29.120 to < 9.29.120.184, 9.30.67 to < 9.30.67.109, 9.31.86 to < 9.31.86.71—
WSO2org.wso2.carbon:org.wso2.carbon.base4.4.7 to < 4.4.7.6, 4.4.9 to < 4.4.9.11, 4.4.11 to < 4.4.11.9, 4.4.26 to < 4.4.26.12, 4.4.35 to < 4.4.35.44, 4.5.1 to < 4.5.1.43, 4.6.0 to < 4.6.0.1990, 4.6.1 to < 4.6.1.149, 4.6.2 to < 4.6.2.667, 4.6.3 to < 4.6.3.36, 4.6.4 to < 4.6.4.14, 4.7.1 to < 4.7.1.68, 4.8.1 to < 4.8.1.39, 4.9.0 to < 4.9.0.99, 4.9.26 to < 4.9.26.25, 4.9.27 to < 4.9.27.10, 4.9.28 to < 4.9.28.11, 4.10.9 to < 4.10.9.66, 4.10.42 to < 4.10.42.9, 4.9 to < 4.9.29, 4.10 to < 4.10.94—
WSO2org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt5.2.0 to < 5.2.0.4, 5.2.2 to < 5.2.2.21, 5.7.5 to < 5.7.5.18, 5.11.148 to < 5.11.148.19, 5.11.256 to < 5.11.256.21, 5.12.153 to < 5.12.153.63, 5.12.387 to < 5.12.387.46, 5.14.97 to < 5.14.97.89, 5.17.5 to < 5.17.5.317, 5.17.118 to < 5.17.118.17, 5.18.187 to < 5.18.187.309, 5.18.248 to < 5.18.248.30, 5.23.8 to < 5.23.8.207, 5.24.8 to < 5.24.8.23, 5.25.92 to < 5.25.92.152, 5.25.705 to < 5.25.705.19, 5.25.713 to < 5.25.713.9, 5.25.724 to < 5.25.724.3, 7.0.78 to < 7.0.78.133, 7.8.23 to < 7.8.23.47, 5.25 to < 5.25.734—
WSO2org.wso2.carbon:org.wso2.carbon.server.admin4.4.7 to < 4.4.7.6, 4.4.9 to < 4.4.9.11, 4.4.11 to < 4.4.11.9, 4.4.26 to < 4.4.26.12, 4.4.32 to < 4.4.32.16, 4.4.35 to < 4.4.35.44, 4.5.1 to < 4.5.1.43, 4.6.0 to < 4.6.0.1990, 4.6.1 to < 4.6.1.149, 4.6.2 to < 4.6.2.667, 4.6.3 to < 4.6.3.36, 4.6.4 to < 4.6.4.14, 4.7.1 to < 4.7.1.68, 4.8.1 to < 4.8.1.39, 4.9.0 to < 4.9.0.99, 4.9.26 to < 4.9.26.25, 4.9.27 to < 4.9.27.10, 4.9.28 to < 4.9.28.11, 4.10.9 to < 4.10.9.66, 4.10.42 to < 4.10.42.9, 4.9 to < 4.9.29, 4.10 to < 4.10.94—
WSO2org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow5.1.1 to < 5.1.1.1, 5.1.2 to < 5.1.2.1, 5.1.5 to < 5.1.5.1, 5.3.3 to < 5.3.3.1, 5.4.0 to < 5.4.0.4, 5.4.1 to < 5.4.1.5, 5.6.0 to < 5.6.0.1—
06 References
07 Remediation
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution