Critical severity9.6NVD Advisory· Published Oct 16, 2025· Updated Jun 17, 2026

CVE-2025-9804

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WSO2/WSO2 Identity Server as Key Managerv5
Range: 5.3.0
WSO2/WSO2 Open Banking AMv5
Range: 1.4.0
Wso2/Org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflowv5
Range: 5.1.1

Patches

Vulnerability mechanics

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000