Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Priority MEDIUM 44CWE-284Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server as Key Manager (WSO2): 5.3.0.41, 5.5.0.53, 5.6.0.75 +3WSO2 Identity Server (WSO2): 5.2.0.34, 5.3.0.36, 5.4.0.34 +12+19 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WSO2 | WSO2 Identity Server as Key Manager | 5.3.0 to before 5.3.0.41; 5.5.0 to before 5.5.0.53; 5.6.0 to before 5.6.0.75; 5.7.0 to before 5.7.0.125; 5.9.0 to before 5.9.0.176; 5.10.0 to before 5.10.0.359 | 5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176, 5.10.0.359 | Patch available | CNA |
| WSO2 | WSO2 Identity Server | 5.2.0 to before 5.2.0.34; 5.3.0 to before 5.3.0.36; 5.4.0 to before 5.4.0.34; 5.4.1 to before 5.4.1.38; 5.5.0 to before 5.5.0.52; 5.6.0 to before 5.6.0.60; 5.7.0 to before 5.7.0.126; 5.8.0 to before 5.8.0.110; 5.9.0 to before 5.9.0.169; 5.10.0 to before 5.10.0.369; 5.11.0 to before 5.11.0.413; 6.0.0 to before 6.0.0.244; 6.1.0 to before 6.1.0.243; 7.0.0 to before 7.0.0.118; 7.1.0 to before 7.1.0.25 | 5.2.0.34, 5.3.0.36, 5.4.0.34, 5.4.1.38, 5.5.0.52, 5.6.0.60, 5.7.0.126, 5.8.0.110, 5.9.0.169, 5.10.0.369, 5.11.0.413, 6.0.0.244, 6.1.0.243, 7.0.0.118, 7.1.0.25 | Patch available | CNA |
| WSO2 | WSO2 Open Banking KM | 1.4.0 to before 1.4.0.133; 1.5.0 to before 1.5.0.123 | 1.4.0.133, 1.5.0.123 | Patch available | CNA |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 to before 2.0.0.409 | 2.0.0.409 | Patch available | CNA |
| WSO2 | WSO2 Open Banking AM | 1.4.0 to before 1.4.0.139; 1.5.0 to before 1.5.0.140; 2.0.0 to before 2.0.0.389 | 1.4.0.139, 1.5.0.140, 2.0.0.389 | Patch available | CNA |
| WSO2 | WSO2 API Manager | 2.0.0 to before 2.0.0.31; 2.1.0 to before 2.1.0.40; 2.2.0 to before 2.2.0.59; 2.5.0 to before 2.5.0.85; 2.6.0 to before 2.6.0.146; 3.0.0 to before 3.0.0.176; 3.1.0 to before 3.1.0.340; 3.2.0 to before 3.2.0.441; 3.2.1 to before 3.2.1.61; 4.0.0 to before 4.0.0.361; 4.1.0 to before 4.1.0.224; 4.2.0 to before 4.2.0.162; 4.3.0 to before 4.3.0.75; 4.4.0 to before 4.4.0.39; 4.5.0 to before 4.5.0.23 | 2.0.0.31, 2.1.0.40, 2.2.0.59, 2.5.0.85, 2.6.0.146, 3.0.0.176, 3.1.0.340, 3.2.0.441, 3.2.1.61, 4.0.0.361, 4.1.0.224, 4.2.0.162, 4.3.0.75, 4.4.0.39, 4.5.0.23 | Patch available | CNA |
| WSO2 | WSO2 Identity Server Analytics | 5.2.0 to before 5.2.0.19; 5.3.0 to before 5.3.0.17; 5.5.0 to before 5.5.0.31; 5.6.0 to before 5.6.0.38 | 5.2.0.19, 5.3.0.17, 5.5.0.31, 5.6.0.38 | Patch available | CNA |
| WSO2 | API Manager Analytics | 2.0.0 to before 2.0.0.14; 2.1.0 to before 2.1.0.19; 2.2.0 to before 2.2.0.30; 2.5.0 to before 2.5.0.39 | 2.0.0.14, 2.1.0.19, 2.2.0.30, 2.5.0.39 | Patch available | CNA |
| WSO2 | WSO2 Enterprise Integrator | 6.2.0 to before 6.2.0.62; 6.3.0 to before 6.3.0.70 | 6.2.0.62, 6.3.0.70 | Patch available | CNA |
| WSO2 | WSO2 Enterprise Service Bus Analytics | 5.0.0 to before 5.0.0.13 | 5.0.0.13 | Patch available | CNA |
| WSO2 | WSO2 Data Analytics Server | 3.1.0 to before 3.1.0.20; 3.2.0 to before 3.2.0.33 | 3.1.0.20, 3.2.0.33 | Patch available | CNA |
| WSO2 | WSO2 Enterprise Mobility Manager | 2.2.0 to before 2.2.0.28 | 2.2.0.28 | Patch available | CNA |
| WSO2 | WSO2 Universal Gateway | 4.5.0 to before 4.5.0.22 | 4.5.0.22 | Patch available | CNA |
| WSO2 | WSO2 API Control Plane | 4.5.0 to before 4.5.0.24 | 4.5.0.24 | Patch available | CNA |
| WSO2 | WSO2 Traffic Manager | 4.5.0 to before 4.5.0.22 | 4.5.0.22 | Patch available | CNA |
| WSO2 | org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector | 2.0.10 to before 2.0.10.1; 2.0.15 to before 2.0.15.1; 2.0.21 to before 2.0.21.1; 2.0.22 to before 2.0.22.1; 2.1.12 to before 2.1.12.1; 2.1 to before 2.1.1972; 2.2 to before 2.2.24; 2.2 to before 2.2.25; 3.1.0 to before 3.1.0.74; 3.3.6 to before 3.3.6.7; 3.3.26 to before 3.3.26.2; 3.3.35 to before 3.3.35.1 | 2.0.10.1, 2.0.15.1, 2.0.21.1, 2.0.22.1, 2.1.12.1, 2.1.1972, 2.2.24, 2.2.25, 3.1.0.74, 3.3.6.7, 3.3.26.2, 3.3.35.1, 3.3.41 | Patch available | CNA |
| WSO2 | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util | 6.7.206 to before 6.7.206.567; 6.7.210 to before 6.7.210.63; 9.0.174 to before 9.0.174.522; 9.20.74 to before 9.20.74.379; 9.28.116 to before 9.28.116.360; 9.29.120 to before 9.29.120.184; 9.30.67 to before 9.30.67.109; 9.31.86 to before 9.31.86.71 | 6.7.206.567, 6.7.210.63, 9.0.174.522, 9.20.74.379, 9.28.116.360, 9.29.120.184, 9.30.67.109, 9.31.86.71, 9.32.133 | Patch available | CNA |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.4.7 to before 4.4.7.6; 4.4.9 to before 4.4.9.11; 4.4.11 to before 4.4.11.9; 4.4.26 to before 4.4.26.12; 4.4.35 to before 4.4.35.44; 4.5.1 to before 4.5.1.43; 4.6.0 to before 4.6.0.1990; 4.6.1 to before 4.6.1.149; 4.6.2 to before 4.6.2.667; 4.6.3 to before 4.6.3.36; 4.6.4 to before 4.6.4.14; 4.7.1 to before 4.7.1.68; 4.8.1 to before 4.8.1.39; 4.9.0 to before 4.9.0.99; 4.9.26 to before 4.9.26.25; 4.9.27 to before 4.9.27.10; 4.9.28 to before 4.9.28.11; 4.10.9 to before 4.10.9.66; 4.10.42 to before 4.10.42.9; 4.9 to before 4.9.29; 4.10 to before 4.10.94 | 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94 | Patch available | CNA |
| WSO2 | org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt | 5.2.0 to before 5.2.0.4; 5.2.2 to before 5.2.2.21; 5.7.5 to before 5.7.5.18; 5.11.148 to before 5.11.148.19; 5.11.256 to before 5.11.256.21; 5.12.153 to before 5.12.153.63; 5.12.387 to before 5.12.387.46; 5.14.97 to before 5.14.97.89; 5.17.5 to before 5.17.5.317; 5.17.118 to before 5.17.118.17; 5.18.187 to before 5.18.187.309; 5.18.248 to before 5.18.248.30; 5.23.8 to before 5.23.8.207; 5.24.8 to before 5.24.8.23; 5.25.92 to before 5.25.92.152; 5.25.705 to before 5.25.705.19; 5.25.713 to before 5.25.713.9; 5.25.724 to before 5.25.724.3; 7.0.78 to before 7.0.78.133; 7.8.23 to before 7.8.23.47; 5.25 to before 5.25.734 | 5.2.0.4, 5.2.2.21, 5.7.5.18, 5.11.148.19, 5.11.256.21, 5.12.153.63, 5.12.387.46, 5.14.97.89, 5.17.5.317, 5.17.118.17, 5.18.187.309, 5.18.248.30, 5.23.8.207, 5.24.8.23, 5.25.92.152, 5.25.705.19, 5.25.713.9, 5.25.724.3, 7.0.78.133, 7.8.23.47, 5.25.734, 7.8.489 | Patch available | CNA |
| WSO2 | org.wso2.carbon:org.wso2.carbon.server.admin | 4.4.7 to before 4.4.7.6; 4.4.9 to before 4.4.9.11; 4.4.11 to before 4.4.11.9; 4.4.26 to before 4.4.26.12; 4.4.32 to before 4.4.32.16; 4.4.35 to before 4.4.35.44; 4.5.1 to before 4.5.1.43; 4.6.0 to before 4.6.0.1990; 4.6.1 to before 4.6.1.149; 4.6.2 to before 4.6.2.667; 4.6.3 to before 4.6.3.36; 4.6.4 to before 4.6.4.14; 4.7.1 to before 4.7.1.68; 4.8.1 to before 4.8.1.39; 4.9.0 to before 4.9.0.99; 4.9.26 to before 4.9.26.25; 4.9.27 to before 4.9.27.10; 4.9.28 to before 4.9.28.11; 4.10.9 to before 4.10.9.66; 4.10.42 to before 4.10.42.9; 4.9 to before 4.9.29; 4.10 to before 4.10.94 | 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.32.16, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94 | Patch available | CNA |
| WSO2 | org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow | 5.1.1 to before 5.1.1.1; 5.1.2 to before 5.1.2.1; 5.1.5 to before 5.1.5.1; 5.3.3 to before 5.3.3.1; 5.4.0 to before 5.4.0.4; 5.4.1 to before 5.4.1.5; 5.6.0 to before 5.6.0.1 | 5.1.1.1, 5.1.2.1, 5.1.5.1, 5.3.3.1, 5.4.0.4, 5.4.1.5, 5.6.0.1, 5.6.21 | Patch available | CNA |
- WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.3.0 to before 5.3.0.41; 5.5.0 to before 5.5.0.53; 5.6.0 to before 5.6.0.75; 5.7.0 to before 5.7.0.125; 5.9.0 to before 5.9.0.176; 5.10.0 to before 5.10.0.359 Fixed in 5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176, 5.10.0.359 Patch available CNA
- WSO2 Identity Server VendorWSO2 Affected 5.2.0 to before 5.2.0.34; 5.3.0 to before 5.3.0.36; 5.4.0 to before 5.4.0.34; 5.4.1 to before 5.4.1.38; 5.5.0 to before 5.5.0.52; 5.6.0 to before 5.6.0.60; 5.7.0 to before 5.7.0.126; 5.8.0 to before 5.8.0.110; 5.9.0 to before 5.9.0.169; 5.10.0 to before 5.10.0.369; 5.11.0 to before 5.11.0.413; 6.0.0 to before 6.0.0.244; 6.1.0 to before 6.1.0.243; 7.0.0 to before 7.0.0.118; 7.1.0 to before 7.1.0.25 Fixed in 5.2.0.34, 5.3.0.36, 5.4.0.34, 5.4.1.38, 5.5.0.52, 5.6.0.60, 5.7.0.126, 5.8.0.110, 5.9.0.169, 5.10.0.369, 5.11.0.413, 6.0.0.244, 6.1.0.243, 7.0.0.118, 7.1.0.25 Patch available CNA
- WSO2 Open Banking KM VendorWSO2 Affected 1.4.0 to before 1.4.0.133; 1.5.0 to before 1.5.0.123 Fixed in 1.4.0.133, 1.5.0.123 Patch available CNA
- WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.409 Fixed in 2.0.0.409 Patch available CNA
- WSO2 Open Banking AM VendorWSO2 Affected 1.4.0 to before 1.4.0.139; 1.5.0 to before 1.5.0.140; 2.0.0 to before 2.0.0.389 Fixed in 1.4.0.139, 1.5.0.140, 2.0.0.389 Patch available CNA
- WSO2 API Manager VendorWSO2 Affected 2.0.0 to before 2.0.0.31; 2.1.0 to before 2.1.0.40; 2.2.0 to before 2.2.0.59; 2.5.0 to before 2.5.0.85; 2.6.0 to before 2.6.0.146; 3.0.0 to before 3.0.0.176; 3.1.0 to before 3.1.0.340; 3.2.0 to before 3.2.0.441; 3.2.1 to before 3.2.1.61; 4.0.0 to before 4.0.0.361; 4.1.0 to before 4.1.0.224; 4.2.0 to before 4.2.0.162; 4.3.0 to before 4.3.0.75; 4.4.0 to before 4.4.0.39; 4.5.0 to before 4.5.0.23 Fixed in 2.0.0.31, 2.1.0.40, 2.2.0.59, 2.5.0.85, 2.6.0.146, 3.0.0.176, 3.1.0.340, 3.2.0.441, 3.2.1.61, 4.0.0.361, 4.1.0.224, 4.2.0.162, 4.3.0.75, 4.4.0.39, 4.5.0.23 Patch available CNA
- WSO2 Identity Server Analytics VendorWSO2 Affected 5.2.0 to before 5.2.0.19; 5.3.0 to before 5.3.0.17; 5.5.0 to before 5.5.0.31; 5.6.0 to before 5.6.0.38 Fixed in 5.2.0.19, 5.3.0.17, 5.5.0.31, 5.6.0.38 Patch available CNA
- API Manager Analytics VendorWSO2 Affected 2.0.0 to before 2.0.0.14; 2.1.0 to before 2.1.0.19; 2.2.0 to before 2.2.0.30; 2.5.0 to before 2.5.0.39 Fixed in 2.0.0.14, 2.1.0.19, 2.2.0.30, 2.5.0.39 Patch available CNA
- WSO2 Enterprise Integrator VendorWSO2 Affected 6.2.0 to before 6.2.0.62; 6.3.0 to before 6.3.0.70 Fixed in 6.2.0.62, 6.3.0.70 Patch available CNA
- WSO2 Enterprise Service Bus Analytics VendorWSO2 Affected 5.0.0 to before 5.0.0.13 Fixed in 5.0.0.13 Patch available CNA
- WSO2 Data Analytics Server VendorWSO2 Affected 3.1.0 to before 3.1.0.20; 3.2.0 to before 3.2.0.33 Fixed in 3.1.0.20, 3.2.0.33 Patch available CNA
- WSO2 Enterprise Mobility Manager VendorWSO2 Affected 2.2.0 to before 2.2.0.28 Fixed in 2.2.0.28 Patch available CNA
- WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.22 Fixed in 4.5.0.22 Patch available CNA
- WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.24 Fixed in 4.5.0.24 Patch available CNA
- WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.22 Fixed in 4.5.0.22 Patch available CNA
- org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector VendorWSO2 Affected 2.0.10 to before 2.0.10.1; 2.0.15 to before 2.0.15.1; 2.0.21 to before 2.0.21.1; 2.0.22 to before 2.0.22.1; 2.1.12 to before 2.1.12.1; 2.1 to before 2.1.1972; 2.2 to before 2.2.24; 2.2 to before 2.2.25; 3.1.0 to before 3.1.0.74; 3.3.6 to before 3.3.6.7; 3.3.26 to before 3.3.26.2; 3.3.35 to before 3.3.35.1 Fixed in 2.0.10.1, 2.0.15.1, 2.0.21.1, 2.0.22.1, 2.1.12.1, 2.1.1972, 2.2.24, 2.2.25, 3.1.0.74, 3.3.6.7, 3.3.26.2, 3.3.35.1, 3.3.41 Patch available CNA
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util VendorWSO2 Affected 6.7.206 to before 6.7.206.567; 6.7.210 to before 6.7.210.63; 9.0.174 to before 9.0.174.522; 9.20.74 to before 9.20.74.379; 9.28.116 to before 9.28.116.360; 9.29.120 to before 9.29.120.184; 9.30.67 to before 9.30.67.109; 9.31.86 to before 9.31.86.71 Fixed in 6.7.206.567, 6.7.210.63, 9.0.174.522, 9.20.74.379, 9.28.116.360, 9.29.120.184, 9.30.67.109, 9.31.86.71, 9.32.133 Patch available CNA
- org.wso2.carbon:org.wso2.carbon.base VendorWSO2 Affected 4.4.7 to before 4.4.7.6; 4.4.9 to before 4.4.9.11; 4.4.11 to before 4.4.11.9; 4.4.26 to before 4.4.26.12; 4.4.35 to before 4.4.35.44; 4.5.1 to before 4.5.1.43; 4.6.0 to before 4.6.0.1990; 4.6.1 to before 4.6.1.149; 4.6.2 to before 4.6.2.667; 4.6.3 to before 4.6.3.36; 4.6.4 to before 4.6.4.14; 4.7.1 to before 4.7.1.68; 4.8.1 to before 4.8.1.39; 4.9.0 to before 4.9.0.99; 4.9.26 to before 4.9.26.25; 4.9.27 to before 4.9.27.10; 4.9.28 to before 4.9.28.11; 4.10.9 to before 4.10.9.66; 4.10.42 to before 4.10.42.9; 4.9 to before 4.9.29; 4.10 to before 4.10.94 Fixed in 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94 Patch available CNA
- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt VendorWSO2 Affected 5.2.0 to before 5.2.0.4; 5.2.2 to before 5.2.2.21; 5.7.5 to before 5.7.5.18; 5.11.148 to before 5.11.148.19; 5.11.256 to before 5.11.256.21; 5.12.153 to before 5.12.153.63; 5.12.387 to before 5.12.387.46; 5.14.97 to before 5.14.97.89; 5.17.5 to before 5.17.5.317; 5.17.118 to before 5.17.118.17; 5.18.187 to before 5.18.187.309; 5.18.248 to before 5.18.248.30; 5.23.8 to before 5.23.8.207; 5.24.8 to before 5.24.8.23; 5.25.92 to before 5.25.92.152; 5.25.705 to before 5.25.705.19; 5.25.713 to before 5.25.713.9; 5.25.724 to before 5.25.724.3; 7.0.78 to before 7.0.78.133; 7.8.23 to before 7.8.23.47; 5.25 to before 5.25.734 Fixed in 5.2.0.4, 5.2.2.21, 5.7.5.18, 5.11.148.19, 5.11.256.21, 5.12.153.63, 5.12.387.46, 5.14.97.89, 5.17.5.317, 5.17.118.17, 5.18.187.309, 5.18.248.30, 5.23.8.207, 5.24.8.23, 5.25.92.152, 5.25.705.19, 5.25.713.9, 5.25.724.3, 7.0.78.133, 7.8.23.47, 5.25.734, 7.8.489 Patch available CNA
- org.wso2.carbon:org.wso2.carbon.server.admin VendorWSO2 Affected 4.4.7 to before 4.4.7.6; 4.4.9 to before 4.4.9.11; 4.4.11 to before 4.4.11.9; 4.4.26 to before 4.4.26.12; 4.4.32 to before 4.4.32.16; 4.4.35 to before 4.4.35.44; 4.5.1 to before 4.5.1.43; 4.6.0 to before 4.6.0.1990; 4.6.1 to before 4.6.1.149; 4.6.2 to before 4.6.2.667; 4.6.3 to before 4.6.3.36; 4.6.4 to before 4.6.4.14; 4.7.1 to before 4.7.1.68; 4.8.1 to before 4.8.1.39; 4.9.0 to before 4.9.0.99; 4.9.26 to before 4.9.26.25; 4.9.27 to before 4.9.27.10; 4.9.28 to before 4.9.28.11; 4.10.9 to before 4.10.9.66; 4.10.42 to before 4.10.42.9; 4.9 to before 4.9.29; 4.10 to before 4.10.94 Fixed in 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.32.16, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94 Patch available CNA
- org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow VendorWSO2 Affected 5.1.1 to before 5.1.1.1; 5.1.2 to before 5.1.2.1; 5.1.5 to before 5.1.5.1; 5.3.3 to before 5.3.3.1; 5.4.0 to before 5.4.0.4; 5.4.1 to before 5.4.1.5; 5.6.0 to before 5.6.0.1 Fixed in 5.1.1.1, 5.1.2.1, 5.1.5.1, 5.3.3.1, 5.4.0.4, 5.4.1.5, 5.6.0.1, 5.6.21 Patch available CNA
CPE configurations NVD · 59
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* | 4.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:* | 2.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Vulnerable | WSO2 |
- cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·WSO2
Show 49 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* | 4.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* | 4.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* | 4.3.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* | 4.4.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* | 4.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager_analytics:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager_analytics:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:* | 2.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:* | 6.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:* | 5.4.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:* | 5.4.1 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:* | 5.6.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:* | 5.7.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:* | 5.8.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:* | 5.9.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* | 5.10.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* | 5.11.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* | 6.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* | 6.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* | 7.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:* | 7.1.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_analytics:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_analytics:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:* | 5.6.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:* | 5.3.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:* | 5.6.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:* | 5.7.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:* | 5.9.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* | 5.10.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* | 4.5.0 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* | 4.5.0 | Vulnerable | WSO2 |
- cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager_analytics:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager_analytics:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* Versions 5.11.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_analytics:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_analytics:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
- cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·WSO2
Remediation
- Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176, 5.10.0.359
- Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.2.0.34, 5.3.0.36, 5.4.0.34, 5.4.1.38, 5.5.0.52, 5.6.0.60, 5.7.0.126, 5.8.0.110, 5.9.0.169, 5.10.0.369, 5.11.0.413, 6.0.0.244, 6.1.0.243, 7.0.0.118, 7.1.0.25
- Fix · CNA WSO2 Open Banking KM (WSO2) Fixed in 1.4.0.133, 1.5.0.123
- Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.409
- Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 1.4.0.139, 1.5.0.140, 2.0.0.389
- Fix · CNA WSO2 API Manager (WSO2) Fixed in 2.0.0.31, 2.1.0.40, 2.2.0.59, 2.5.0.85, 2.6.0.146, 3.0.0.176, 3.1.0.340, 3.2.0.441, 3.2.1.61, 4.0.0.361, 4.1.0.224, 4.2.0.162, 4.3.0.75, 4.4.0.39, 4.5.0.23
- Fix · CNA WSO2 Identity Server Analytics (WSO2) Fixed in 5.2.0.19, 5.3.0.17, 5.5.0.31, 5.6.0.38
- Fix · CNA API Manager Analytics (WSO2) Fixed in 2.0.0.14, 2.1.0.19, 2.2.0.30, 2.5.0.39
- Fix · CNA WSO2 Enterprise Integrator (WSO2) Fixed in 6.2.0.62, 6.3.0.70
- Fix · CNA WSO2 Enterprise Service Bus Analytics (WSO2) Fixed in 5.0.0.13
- Fix · CNA WSO2 Data Analytics Server (WSO2) Fixed in 3.1.0.20, 3.2.0.33
- Fix · CNA WSO2 Enterprise Mobility Manager (WSO2) Fixed in 2.2.0.28
- Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.22
- Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.24
- Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.22
- Fix · CNA org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector (WSO2) Fixed in 2.0.10.1, 2.0.15.1, 2.0.21.1, 2.0.22.1, 2.1.12.1, 2.1.1972, 2.2.24, 2.2.25, 3.1.0.74, 3.3.6.7, 3.3.26.2, 3.3.35.1, 3.3.41
- Fix · CNA org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util (WSO2) Fixed in 6.7.206.567, 6.7.210.63, 9.0.174.522, 9.20.74.379, 9.28.116.360, 9.29.120.184, 9.30.67.109, 9.31.86.71, 9.32.133
- Fix · CNA org.wso2.carbon:org.wso2.carbon.base (WSO2) Fixed in 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94
- Fix · CNA org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt (WSO2) Fixed in 5.2.0.4, 5.2.2.21, 5.7.5.18, 5.11.148.19, 5.11.256.21, 5.12.153.63, 5.12.387.46, 5.14.97.89, 5.17.5.317, 5.17.118.17, 5.18.187.309, 5.18.248.30, 5.23.8.207, 5.24.8.23, 5.25.92.152, 5.25.705.19, 5.25.713.9, 5.25.724.3, 7.0.78.133, 7.8.23.47, 5.25.734, 7.8.489
- Fix · CNA org.wso2.carbon:org.wso2.carbon.server.admin (WSO2) Fixed in 4.4.7.6, 4.4.9.11, 4.4.11.9, 4.4.26.12, 4.4.32.16, 4.4.35.44, 4.5.1.43, 4.6.0.1990, 4.6.1.149, 4.6.2.667, 4.6.3.36, 4.6.4.14, 4.7.1.68, 4.8.1.39, 4.9.0.99, 4.9.26.25, 4.9.27.10, 4.9.28.11, 4.10.9.66, 4.10.42.9, 4.9.29, 4.10.94
- Fix · CNA org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow (WSO2) Fixed in 5.1.1.1, 5.1.2.1, 5.1.5.1, 5.3.3.1, 5.4.0.4, 5.4.1.5, 5.6.0.1, 5.6.21
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9804
- 2026-10-03 Alias added: GHSA-rrm7-q958-j87q
References
More WSO2 Api Control Plane vulnerabilities
- TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
- TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
- TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
- TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
- TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-9804 · CVE Program
- CVE-2025-9804 · NVD
- FIRST EPSS
- GHSA-rrm7-q958-j87q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences