Read the docs
TI-2024-06571 Aliases CVE-2024-7096GHSA-j63j-7r7r-5v4j

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

Priority LOW 26CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00741 54th percentileScored 2026-11-07
Fix Fixed WSO2 Open Banking IAM (WSO2): 2.0.0.364WSO2 Open Banking AM (WSO2): 1.3.0.131, 1.4.0.134, 1.5.0.136 +1+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.3642.0.0.364Patch availableCNA
WSO2WSO2 Open Banking AM1.3.0 to before 1.3.0.131; 1.4.0 to before 1.4.0.134; 1.5.0 to before 1.5.0.136; 2.0.0 to before 2.0.0.3431.3.0.131, 1.4.0.134, 1.5.0.136, 2.0.0.343Patch availableCNA
WSO2WSO2 API Manager2.0.0 to before 2.0.0.29; 2.1.0 to before 2.1.0.39; 2.2.0 to before 2.2.0.56; 2.5.0 to before 2.5.0.83; 2.6.0 to before 2.6.0.142; 3.0.0 to before 3.0.0.162; 3.1.0 to before 3.1.0.294; 3.2.0 to before 3.2.0.384; 3.2.1 to before 3.2.1.16; 4.0.0 to before 4.0.0.305; 4.1.0 to before 4.1.0.166; 4.2.0 to before 4.2.0.101; 4.3.0 to before 4.3.0.162.0.0.29, 2.1.0.39, 2.2.0.56, 2.5.0.83, 2.6.0.142, 3.0.0.162, 3.1.0.294, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.101, 4.3.0.16Patch availableCNA
WSO2WSO2 Enterprise Mobility Manager2.2.0 to before 2.2.0.262.2.0.26Patch availableCNA
WSO2WSO2 Identity Server5.2.0 to before 5.2.0.32; 5.3.0 to before 5.3.0.33; 5.4.1 to before 5.4.1.36; 5.5.0 to before 5.5.0.50; 5.6.0 to before 5.6.0.58; 5.7.0 to before 5.7.0.123; 5.8.0 to before 5.8.0.106; 5.9.0 to before 5.9.0.157; 5.10.0 to before 5.10.0.318; 5.11.0 to before 5.11.0.365; 6.0.0 to before 6.0.0.209; 6.1.0 to before 6.1.0.188; 7.0.0 to before 7.0.0.605.2.0.32, 5.3.0.33, 5.4.1.36, 5.5.0.50, 5.6.0.58, 5.7.0.123, 5.8.0.106, 5.9.0.157, 5.10.0.318, 5.11.0.365, 6.0.0.209, 6.1.0.188, 7.0.0.60Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.3.0 to before 5.3.0.38; 5.5.0 to before 5.5.0.51; 5.6.0 to before 5.6.0.72; 5.7.0 to before 5.7.0.122; 5.9.0 to before 5.9.0.165; 5.10.0 to before 5.10.0.3125.3.0.38, 5.5.0.51, 5.6.0.72, 5.7.0.122, 5.9.0.165, 5.10.0.312Patch availableCNA
WSO2WSO2 Open Banking KM1.3.0 to before 1.3.0.114; 1.4.0 to before 1.4.0.130; 1.5.0 to before 1.5.0.1201.3.0.114, 1.4.0.130, 1.5.0.120Patch availableCNA
—org.wso2.am:am-parent (Maven)2.0.0 to before 4.4.04.4.0Patch availableGHSA-j63j-7r7r-5v4j
—org.wso2.is:identity-server-parent (Maven)5.2.0 to before 7.1.07.1.0Patch availableGHSA-j63j-7r7r-5v4j
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.364 Fixed in 2.0.0.364 Patch available CNA
  • WSO2 Open Banking AM VendorWSO2 Affected 1.3.0 to before 1.3.0.131; 1.4.0 to before 1.4.0.134; 1.5.0 to before 1.5.0.136; 2.0.0 to before 2.0.0.343 Fixed in 1.3.0.131, 1.4.0.134, 1.5.0.136, 2.0.0.343 Patch available CNA
  • WSO2 API Manager VendorWSO2 Affected 2.0.0 to before 2.0.0.29; 2.1.0 to before 2.1.0.39; 2.2.0 to before 2.2.0.56; 2.5.0 to before 2.5.0.83; 2.6.0 to before 2.6.0.142; 3.0.0 to before 3.0.0.162; 3.1.0 to before 3.1.0.294; 3.2.0 to before 3.2.0.384; 3.2.1 to before 3.2.1.16; 4.0.0 to before 4.0.0.305; 4.1.0 to before 4.1.0.166; 4.2.0 to before 4.2.0.101; 4.3.0 to before 4.3.0.16 Fixed in 2.0.0.29, 2.1.0.39, 2.2.0.56, 2.5.0.83, 2.6.0.142, 3.0.0.162, 3.1.0.294, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.101, 4.3.0.16 Patch available CNA
  • WSO2 Enterprise Mobility Manager VendorWSO2 Affected 2.2.0 to before 2.2.0.26 Fixed in 2.2.0.26 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.2.0 to before 5.2.0.32; 5.3.0 to before 5.3.0.33; 5.4.1 to before 5.4.1.36; 5.5.0 to before 5.5.0.50; 5.6.0 to before 5.6.0.58; 5.7.0 to before 5.7.0.123; 5.8.0 to before 5.8.0.106; 5.9.0 to before 5.9.0.157; 5.10.0 to before 5.10.0.318; 5.11.0 to before 5.11.0.365; 6.0.0 to before 6.0.0.209; 6.1.0 to before 6.1.0.188; 7.0.0 to before 7.0.0.60 Fixed in 5.2.0.32, 5.3.0.33, 5.4.1.36, 5.5.0.50, 5.6.0.58, 5.7.0.123, 5.8.0.106, 5.9.0.157, 5.10.0.318, 5.11.0.365, 6.0.0.209, 6.1.0.188, 7.0.0.60 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.3.0 to before 5.3.0.38; 5.5.0 to before 5.5.0.51; 5.6.0 to before 5.6.0.72; 5.7.0 to before 5.7.0.122; 5.9.0 to before 5.9.0.165; 5.10.0 to before 5.10.0.312 Fixed in 5.3.0.38, 5.5.0.51, 5.6.0.72, 5.7.0.122, 5.9.0.165, 5.10.0.312 Patch available CNA
  • WSO2 Open Banking KM VendorWSO2 Affected 1.3.0 to before 1.3.0.114; 1.4.0 to before 1.4.0.130; 1.5.0 to before 1.5.0.120 Fixed in 1.3.0.114, 1.4.0.130, 1.5.0.120 Patch available CNA
  • org.wso2.am:am-parent (Maven) Vendor— Affected 2.0.0 to before 4.4.0 Fixed in 4.4.0 Patch available GHSA-j63j-7r7r-5v4j
  • org.wso2.is:identity-server-parent (Maven) Vendor— Affected 5.2.0 to before 7.1.0 Fixed in 7.1.0 Patch available GHSA-j63j-7r7r-5v4j

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableWSO2
  • cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·WSO2
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*4.1.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*4.2.0VulnerableWSO2
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*4.3.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*5.11.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*6.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*6.1.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*7.0.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableWSO2
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*5.10.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableWSO2
cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableWSO2
  • cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·WSO2
  • cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·WSO2

Remediation

  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.364
  • Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 1.3.0.131, 1.4.0.134, 1.5.0.136, 2.0.0.343
  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 2.0.0.29, 2.1.0.39, 2.2.0.56, 2.5.0.83, 2.6.0.142, 3.0.0.162, 3.1.0.294, 3.2.0.384, 3.2.1.16, 4.0.0.305, 4.1.0.166, 4.2.0.101, 4.3.0.16
  • Fix · CNA WSO2 Enterprise Mobility Manager (WSO2) Fixed in 2.2.0.26
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.2.0.32, 5.3.0.33, 5.4.1.36, 5.5.0.50, 5.6.0.58, 5.7.0.123, 5.8.0.106, 5.9.0.157, 5.10.0.318, 5.11.0.365, 6.0.0.209, 6.1.0.188, 7.0.0.60
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.3.0.38, 5.5.0.51, 5.6.0.72, 5.7.0.122, 5.9.0.165, 5.10.0.312
  • Fix · CNA WSO2 Open Banking KM (WSO2) Fixed in 1.3.0.114, 1.4.0.130, 1.5.0.120
  • Fix · GHSA-j63j-7r7r-5v4j org.wso2.am:am-parent (Maven) Fixed in 4.4.0 Advisory →
  • Fix · GHSA-j63j-7r7r-5v4j org.wso2.is:identity-server-parent (Maven) Fixed in 7.1.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WSO2 API Manager, WSO2 Enterprise Mobility Manager and 4 more products 1.3.0, 1.3.0.114 and 29 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-06572 Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupPriority LOW 21
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7096
  2. 2026-10-03 Alias added: GHSA-j63j-7r7r-5v4j

References

Advisory 2

Other 2

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-12002 A reflected XSS issue exists in the Management Console of several WSO2 products. CVSS 3.1MEDIUM 6.1
  • TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences