Medium
Access control
CVE-2025-9804 — Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
10
Low
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
No exploitation signal in the sources consulted so far.
How the score was calculated
- EPSS 0.6% (30-day exploitation probability)+7
- Technical severity (medium)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.56%
ahead of 45% of scored CVEs · Oct 14, 2026
Affects
WSO2
Api Control Plane and 21 more
CVSS base
6.5
Medium · 3 source(s)
Prioritization reference: 9.6 provisional
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script the kill-chain steps
Technical impact
Total
partial · total control of the vulnerable component
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (WSO2 Api Control Plane, WSO2 Api Manager, WSO2 Api Manager Analytics…).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes matching the vulnerability class (access control), errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| WSO2 | Api Control Plane | version 4.5.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Api Control Plane | ≥ 4.5.0 and < 4.5.0.24 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Api Manager |
version 2.0.0version 2.1.0version 2.2.0version 2.5.0version 2.6.0version 3.0.0version 3.1.0version 3.2.0 and 7 moreversion 3.2.1version 4.0.0version 4.1.0version 4.2.0version 4.3.0version 4.4.0version 4.5.0 |
Vulnerable | NIST National Vulnerability Database |
| WSO2 | Api Manager |
≥ 2.0.0 and < 2.0.0.31≥ 2.1.0 and < 2.1.0.40≥ 2.2.0 and < 2.2.0.59≥ 2.5.0 and < 2.5.0.85≥ 2.6.0 and < 2.6.0.146≥ 3.0.0 and < 3.0.0.176≥ 3.1.0 and < 3.1.0.340≥ 3.2.0 and < 3.2.0.441 and 7 more≥ 3.2.1 and < 3.2.1.61≥ 4.0.0 and < 4.0.0.361≥ 4.1.0 and < 4.1.0.224≥ 4.2.0 and < 4.2.0.162≥ 4.3.0 and < 4.3.0.75≥ 4.4.0 and < 4.4.0.39≥ 4.5.0 and < 4.5.0.23 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Api Manager Analytics | version 2.0.0version 2.1.0version 2.2.0version 2.5.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Api Manager Analytics | ≥ 2.0.0 and < 2.0.0.14≥ 2.1.0 and < 2.1.0.19≥ 2.2.0 and < 2.2.0.30≥ 2.5.0 and < 2.5.0.39 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Data Analytics Server | version 3.1.0version 3.2.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Data Analytics Server | ≥ 3.1.0 and < 3.1.0.20≥ 3.2.0 and < 3.2.0.33 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Enterprise Integrator | version 6.2.0version 6.3.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Enterprise Integrator | ≥ 6.2.0 and < 6.2.0.62≥ 6.3.0 and < 6.3.0.70 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Enterprise Mobility Manager | version 2.2.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Enterprise Mobility Manager | ≥ 2.2.0 and < 2.2.0.28 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Enterprise Service Bus | version 5.0.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Identity Server |
version 5.2.0version 5.3.0version 5.4.0version 5.4.1version 5.5.0version 5.6.0version 5.7.0version 5.8.0 and 7 moreversion 5.9.0version 5.10.0version 5.11.0version 6.0.0version 6.1.0version 7.0.0version 7.1.0 |
Vulnerable | NIST National Vulnerability Database |
| WSO2 | Identity Server |
≥ 5.2.0 and < 5.2.0.34≥ 5.3.0 and < 5.3.0.36≥ 5.4.0 and < 5.4.0.34≥ 5.4.1 and < 5.4.1.38≥ 5.5.0 and < 5.5.0.52≥ 5.6.0 and < 5.6.0.60≥ 5.7.0 and < 5.7.0.126≥ 5.8.0 and < 5.8.0.110 and 7 more≥ 5.9.0 and < 5.9.0.169≥ 5.10.0 and < 5.10.0.369≥ 5.11.0 and < 5.11.0.413≥ 6.0.0 and < 6.0.0.244≥ 6.1.0 and < 6.1.0.243≥ 7.0.0 and < 7.0.0.118≥ 7.1.0 and < 7.1.0.25 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Identity Server Analytics | version 5.2.0version 5.3.0version 5.5.0version 5.6.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Identity Server Analytics | ≥ 5.2.0 and < 5.2.0.19≥ 5.3.0 and < 5.3.0.17≥ 5.5.0 and < 5.5.0.31≥ 5.6.0 and < 5.6.0.38 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Identity Server As Key Manager | version 5.3.0version 5.5.0version 5.6.0version 5.7.0version 5.9.0version 5.10.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Identity Server As Key Manager | ≥ 5.3.0 and < 5.3.0.41≥ 5.5.0 and < 5.5.0.53≥ 5.6.0 and < 5.6.0.75≥ 5.7.0 and < 5.7.0.125≥ 5.9.0 and < 5.9.0.176≥ 5.10.0 and < 5.10.0.359 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Open Banking Am | version 1.4.0version 1.5.0version 2.0.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Open Banking Am | ≥ 1.4.0 and < 1.4.0.139≥ 1.5.0 and < 1.5.0.140≥ 2.0.0 and < 2.0.0.389 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Open Banking Iam | version 2.0.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Open Banking Iam | ≥ 2.0.0 and < 2.0.0.409 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Open Banking Km | version 1.4.0version 1.5.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Open Banking Km | ≥ 1.4.0 and < 1.4.0.133≥ 1.5.0 and < 1.5.0.123 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon:org.wso2.carbon.base |
≥ 4.4.7 and < 4.4.7.6≥ 4.4.11 and < 4.4.11.9≥ 4.4.9 and < 4.4.9.11≥ 4.10 and < 4.10.94≥ 4.9 and < 4.9.29≥ 4.10.42 and < 4.10.42.9≥ 4.10.9 and < 4.10.9.66≥ 4.9.28 and < 4.9.28.11 and 13 more≥ 4.9.27 and < 4.9.27.10≥ 4.9.26 and < 4.9.26.25≥ 4.9.0 and < 4.9.0.99≥ 4.8.1 and < 4.8.1.39≥ 4.6.4 and < 4.6.4.14≥ 4.6.3 and < 4.6.3.36≥ 4.6.2 and < 4.6.2.667≥ 4.6.1 and < 4.6.1.149≥ 4.6.0 and < 4.6.0.1990≥ 4.5.1 and < 4.5.1.43≥ 4.4.35 and < 4.4.35.44≥ 4.4.26 and < 4.4.26.12≥ 4.7.1 and < 4.7.1.68 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon:org.wso2.carbon.server.admin |
≥ 4.7.1 and < 4.7.1.68≥ 4.8.1 and < 4.8.1.39≥ 4.9.0 and < 4.9.0.99≥ 4.9.26 and < 4.9.26.25≥ 4.9.27 and < 4.9.27.10≥ 4.9 and < 4.9.29≥ 4.9.28 and < 4.9.28.11≥ 4.10.9 and < 4.10.9.66 and 14 more≥ 4.10.42 and < 4.10.42.9≥ 4.4.7 and < 4.4.7.6≥ 4.6.4 and < 4.6.4.14≥ 4.6.3 and < 4.6.3.36≥ 4.6.2 and < 4.6.2.667≥ 4.6.1 and < 4.6.1.149≥ 4.6.0 and < 4.6.0.1990≥ 4.5.1 and < 4.5.1.43≥ 4.4.35 and < 4.4.35.44≥ 4.4.32 and < 4.4.32.16≥ 4.4.26 and < 4.4.26.12≥ 4.4.11 and < 4.4.11.9≥ 4.4.9 and < 4.4.9.11≥ 4.10 and < 4.10.94 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util | ≥ 9.30.67 and < 9.30.67.109≥ 9.29.120 and < 9.29.120.184≥ 9.28.116 and < 9.28.116.360≥ 9.20.74 and < 9.20.74.379≥ 9.0.174 and < 9.0.174.522≥ 6.7.210 and < 6.7.210.63≥ 6.7.206 and < 6.7.206.567≥ 9.31.86 and < 9.31.86.71 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector |
≥ 3.1.0 and < 3.1.0.74≥ 2.0.10 and < 2.0.10.1≥ 2.0.15 and < 2.0.15.1≥ 2.0.21 and < 2.0.21.1≥ 2.0.22 and < 2.0.22.1≥ 2.1.12 and < 2.1.12.1≥ 2.1 and < 2.1.1972≥ 2.2 and < 2.2.24 and 4 more≥ 2.2 and < 2.2.25≥ 3.3.6 and < 3.3.6.7≥ 3.3.26 and < 3.3.26.2≥ 3.3.35 and < 3.3.35.1 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt |
≥ 5.11.256 and < 5.11.256.21≥ 7.8.23 and < 7.8.23.47≥ 5.2.0 and < 5.2.0.4≥ 5.2.2 and < 5.2.2.21≥ 5.7.5 and < 5.7.5.18≥ 5.11.148 and < 5.11.148.19≥ 5.12.153 and < 5.12.153.63≥ 5.12.387 and < 5.12.387.46 and 13 more≥ 5.14.97 and < 5.14.97.89≥ 5.17.5 and < 5.17.5.317≥ 5.17.118 and < 5.17.118.17≥ 5.18.248 and < 5.18.248.30≥ 5.25 and < 5.25.734≥ 7.0.78 and < 7.0.78.133≥ 5.25.724 and < 5.25.724.3≥ 5.25.713 and < 5.25.713.9≥ 5.25.705 and < 5.25.705.19≥ 5.25.92 and < 5.25.92.152≥ 5.24.8 and < 5.24.8.23≥ 5.23.8 and < 5.23.8.207≥ 5.18.187 and < 5.18.187.309 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow | ≥ 5.1.1 and < 5.1.1.1≥ 5.1.2 and < 5.1.2.1≥ 5.1.5 and < 5.1.5.1≥ 5.3.3 and < 5.3.3.1≥ 5.4.0 and < 5.4.0.4≥ 5.4.1 and < 5.4.1.5≥ 5.6.0 and < 5.6.0.1 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Traffic Manager | version 4.5.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Traffic Manager | ≥ 4.5.0 and < 4.5.0.22 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | Universal Gateway | version 4.5.0 | Vulnerable | NIST National Vulnerability Database |
| WSO2 | Universal Gateway | ≥ 4.5.0 and < 4.5.0.22 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| WSO2 | WSO2 Enterprise Service Bus Analytics | ≥ 5.0.0 and < 5.0.0.13 | Vulnerable | CVE Program (cve.org) e CISA ADP |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 9.6 | CVSS 3.1 | Critical | 2.8 | 6.0 | ed10eef1-636d-4fbe-9993-6890dfa878f8 via NIST National Vulnerability Database |
| 9.6 | CVSS 3.1 | Critical | — | — | WSO2 via CVE Program (cve.org) e CISA ADP |
| 8.9 | CVSS 3.1 | High | — | — | WSO2 via CVE Program (cve.org) e CISA ADP |
| 6.5 | CVSS 3.1 | Medium | 2.8 | 3.6 | nvd@nist.gov via NIST National Vulnerability Database |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (score shown at the top: nvd@nist.gov)
Scoring entities (NIST, CNA, ADP) score independently; each score is shown with its origin. For prioritization we use 9.6 (ed10eef1-636d-4fbe-9993-6890dfa878f8 via NIST National Vulnerability Database) as a conservative provisional reference — not a definitive official score.
Weakness MITRE
Weakness class according to MITRE’s CWE catalog.
EPSS over time FIRST
Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 0.56%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
- Audit administrative actions and access to resources outside each user’s normal pattern.
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · wso2/wso2 identity server as key manager, wso2/wso2 identity server, wso2/wso2 open banking km, wso2/wso2 open banking i
- SSVC assessment updated
- Record published
- CVSS changed · 6.5
- Source status changed · → Analyzed
- Record created in this database
- 2025
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 13, 2026 – Oct 13, 2026
References
1 on the record
Elsewhere on this site
Related CVEs (same products)
- Medium CVE-2024-8122 Potential brute force vulnerability due to non-expiring SMS OTPs 7d
- Low CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery Sep 15, 2026
- Critical CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability KEV Aug 6, 2026
- Medium CVE-2025-8591 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification Jul 6, 2026
- High CVE-2025-13475 Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure Jul 4, 2026
- Critical CVE-2026-2053 WSO2 API Manager SSRF via WS-Addressing Headers in Message Flow Jun 26, 2026
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No fixed version, patch or mitigation documented.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2025-9804 is "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs", rated Medium. It affects Api Control Plane (WSO2); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 6.5 describes technical severity. EPSS 0.56% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.