Unrated severityNVD Advisory· Published Oct 16, 2025· Updated Oct 17, 2025

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

CVE-2025-9804

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Affected products

Wso2/Org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflowv5
Range: 5.1.1
WSO2/WSO2 Identity Server as Key Managerv5
Range: 5.3.0
WSO2/WSO2 Open Banking AMv5
Range: 1.4.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/mitrevendor-advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000