Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs_CVE-2025-9804

{
    "lastseen": "",
    "description": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.",
    "published": "2025-10-16T12:33:45.426Z",
    "modified": "2025-10-16T13:21:25.991Z",
    "type": "cve",
    "title": "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs",
    "source": "WSO2",
    "references": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/",
    "id": "CVE-2025-9804",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "WSO2 WSO2 Identity Server as Key Manager 5.3.0\nWSO2 WSO2 Identity Server as Key Manager 5.5.0\nWSO2 WSO2 Identity Server as Key Manager 5.6.0\nWSO2 WSO2 Identity Server as Key Manager 5.7.0\nWSO2 WSO2 Identity Server as Key Manager 5.9.0\nWSO2 WSO2 Identity Server as Key Manager 5.10.0\nWSO2 WSO2 Identity Server 5.2.0\nWSO2 WSO2 Identity Server 5.3.0\nWSO2 WSO2 Identity Server 5.4.0\nWSO2 WSO2 Identity Server 5.4.1\nWSO2 WSO2 Identity Server 5.5.0\nWSO2 WSO2 Identity Server 5.6.0\nWSO2 WSO2 Identity Server 5.7.0\nWSO2 WSO2 Identity Server 5.8.0\nWSO2 WSO2 Identity Server 5.9.0\nWSO2 WSO2 Identity Server 5.10.0\nWSO2 WSO2 Identity Server 5.11.0\nWSO2 WSO2 Identity Server 6.0.0\nWSO2 WSO2 Identity Server 6.1.0\nWSO2 WSO2 Identity Server 7.0.0\nWSO2 WSO2 Identity Server 7.1.0\nWSO2 WSO2 Open Banking KM 1.4.0\nWSO2 WSO2 Open Banking KM 1.5.0\nWSO2 WSO2 Open Banking IAM 2.0.0\nWSO2 WSO2 Open Banking AM 1.4.0\nWSO2 WSO2 Open Banking AM 1.5.0\nWSO2 WSO2 Open Banking AM 2.0.0\nWSO2 WSO2 API Manager 2.0.0\nWSO2 WSO2 API Manager 2.1.0\nWSO2 WSO2 API Manager 2.2.0\nWSO2 WSO2 API Manager 2.5.0\nWSO2 WSO2 API Manager 2.6.0\nWSO2 WSO2 API Manager 3.0.0\nWSO2 WSO2 API Manager 3.1.0\nWSO2 WSO2 API Manager 3.2.0\nWSO2 WSO2 API Manager 3.2.1\nWSO2 WSO2 API Manager 4.0.0\nWSO2 WSO2 API Manager 4.1.0\nWSO2 WSO2 API Manager 4.2.0\nWSO2 WSO2 API Manager 4.3.0\nWSO2 WSO2 API Manager 4.4.0\nWSO2 WSO2 API Manager 4.5.0\nWSO2 WSO2 Identity Server Analytics 5.2.0\nWSO2 WSO2 Identity Server Analytics 5.3.0\nWSO2 WSO2 Identity Server Analytics 5.5.0\nWSO2 WSO2 Identity Server Analytics 5.6.0\nWSO2 API Manager Analytics 2.0.0\nWSO2 API Manager Analytics 2.1.0\nWSO2 API Manager Analytics 2.2.0\nWSO2 API Manager Analytics 2.5.0\nWSO2 WSO2 Enterprise Integrator 6.2.0\nWSO2 WSO2 Enterprise Integrator 6.3.0\nWSO2 WSO2 Enterprise Service Bus Analytics 5.0.0\nWSO2 WSO2 Data Analytics Server 3.1.0\nWSO2 WSO2 Data Analytics Server 3.2.0\nWSO2 WSO2 Enterprise Mobility Manager 2.2.0\nWSO2 WSO2 Universal Gateway 4.5.0\nWSO2 WSO2 API Control Plane 4.5.0\nWSO2 WSO2 Traffic Manager 4.5.0\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.10\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.15\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.21\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.0.22\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.1.12\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.1\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.2\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 2.2\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 3.1.0\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 3.3.6\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 3.3.26\nWSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector 3.3.35\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 6.7.206\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 6.7.210\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.0.174\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.20.74\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.28.116\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.29.120\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.30.67\nWSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util 9.31.86\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.7\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.9\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.11\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.26\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.4.35\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.5.1\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.6.0\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.6.1\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.6.2\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.6.3\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.6.4\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.7.1\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.8.1\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.9.0\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.9.26\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.9.27\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.9.28\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.10.9\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.10.42\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.9\nWSO2 org.wso2.carbon:org.wso2.carbon.base 4.10\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.2.0\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.2.2\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.7.5\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.11.148\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.11.256\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.12.153\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.12.387\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.14.97\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.17.5\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.17.118\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.18.187\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.18.248\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.23.8\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.24.8\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.25.92\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.25.705\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.25.713\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.25.724\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 7.0.78\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 7.8.23\nWSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt 5.25\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.7\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.9\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.11\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.26\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.32\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.4.35\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.5.1\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.6.0\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.6.1\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.6.2\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.6.3\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.6.4\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.7.1\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.8.1\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.9.0\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.9.26\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.9.27\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.9.28\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.10.9\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.10.42\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.9\nWSO2 org.wso2.carbon:org.wso2.carbon.server.admin 4.10\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.1.1\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.1.2\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.1.5\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.3.3\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.4.0\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.4.1\nWSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow 5.6.0",
    "sourceHref": "",
    "cvss": {
        "score": 9.6,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "WSO2 Identity Server as Key Manager",
    "version": "0",
    "vendor": "WSO2",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}