cveboard RSS feed

CVE-2025-9804

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.3.0UnavailableNone listed
5.3.0affectedcustom5.3.0.41UnavailableNone listed
5.5.0affectedcustom5.5.0.53UnavailableNone listed
5.6.0affectedcustom5.6.0.75UnavailableNone listed
5.7.0affectedcustom5.7.0.125UnavailableNone listed
5.9.0affectedcustom5.9.0.176UnavailableNone listed
5.10.0affectedcustom5.10.0.359UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.2.0UnavailableNone listed
5.2.0affectedcustom5.2.0.34UnavailableNone listed
5.3.0affectedcustom5.3.0.36UnavailableNone listed
5.4.0affectedcustom5.4.0.34UnavailableNone listed
5.4.1affectedcustom5.4.1.38UnavailableNone listed
5.5.0affectedcustom5.5.0.52UnavailableNone listed
5.6.0affectedcustom5.6.0.60UnavailableNone listed
5.7.0affectedcustom5.7.0.126UnavailableNone listed
5.8.0affectedcustom5.8.0.110UnavailableNone listed
5.9.0affectedcustom5.9.0.169UnavailableNone listed
5.10.0affectedcustom5.10.0.369UnavailableNone listed
5.11.0affectedcustom5.11.0.413UnavailableNone listed
6.0.0affectedcustom6.0.0.244UnavailableNone listed
6.1.0affectedcustom6.1.0.243UnavailableNone listed
7.0.0affectedcustom7.0.0.118UnavailableNone listed
7.1.0affectedcustom7.1.0.25UnavailableNone listed

WSO2 Open Banking KM

Vendor
WSO2
Product
WSO2 Open Banking KM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking KM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.4.0UnavailableNone listed
1.4.0affectedcustom1.4.0.133UnavailableNone listed
1.5.0affectedcustom1.5.0.123UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.409UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom1.4.0UnavailableNone listed
1.4.0affectedcustom1.4.0.139UnavailableNone listed
1.5.0affectedcustom1.5.0.140UnavailableNone listed
2.0.0affectedcustom2.0.0.389UnavailableNone listed

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.31UnavailableNone listed
2.1.0affectedcustom2.1.0.40UnavailableNone listed
2.2.0affectedcustom2.2.0.59UnavailableNone listed
2.5.0affectedcustom2.5.0.85UnavailableNone listed
2.6.0affectedcustom2.6.0.146UnavailableNone listed
3.0.0affectedcustom3.0.0.176UnavailableNone listed
3.1.0affectedcustom3.1.0.340UnavailableNone listed
3.2.0affectedcustom3.2.0.441UnavailableNone listed
3.2.1affectedcustom3.2.1.61UnavailableNone listed
4.0.0affectedcustom4.0.0.361UnavailableNone listed
4.1.0affectedcustom4.1.0.224UnavailableNone listed
4.2.0affectedcustom4.2.0.162UnavailableNone listed
4.3.0affectedcustom4.3.0.75UnavailableNone listed
4.4.0affectedcustom4.4.0.39UnavailableNone listed
4.5.0affectedcustom4.5.0.23UnavailableNone listed

WSO2 Identity Server Analytics

Vendor
WSO2
Product
WSO2 Identity Server Analytics
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server Analytics · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.2.0UnavailableNone listed
5.2.0affectedcustom5.2.0.19UnavailableNone listed
5.3.0affectedcustom5.3.0.17UnavailableNone listed
5.5.0affectedcustom5.5.0.31UnavailableNone listed
5.6.0affectedcustom5.6.0.38UnavailableNone listed

API Manager Analytics

Vendor
WSO2
Product
API Manager Analytics
Platforms
Unknown
Default status
unaffected
API Manager Analytics · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.14UnavailableNone listed
2.1.0affectedcustom2.1.0.19UnavailableNone listed
2.2.0affectedcustom2.2.0.30UnavailableNone listed
2.5.0affectedcustom2.5.0.39UnavailableNone listed

WSO2 Enterprise Integrator

Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom6.2.0UnavailableNone listed
6.2.0affectedcustom6.2.0.62UnavailableNone listed
6.3.0affectedcustom6.3.0.70UnavailableNone listed

WSO2 Enterprise Service Bus Analytics

Vendor
WSO2
Product
WSO2 Enterprise Service Bus Analytics
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Service Bus Analytics · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.0.0UnavailableNone listed
5.0.0affectedcustom5.0.0.13UnavailableNone listed

WSO2 Data Analytics Server

Vendor
WSO2
Product
WSO2 Data Analytics Server
Platforms
Unknown
Default status
unaffected
WSO2 Data Analytics Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.20UnavailableNone listed
3.2.0affectedcustom3.2.0.33UnavailableNone listed

WSO2 Enterprise Mobility Manager

Vendor
WSO2
Product
WSO2 Enterprise Mobility Manager
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Mobility Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.2.0UnavailableNone listed
2.2.0affectedcustom2.2.0.28UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.22UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.24UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.22UnavailableNone listed

org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector

Vendor
WSO2
Product
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.0.10affectedcustom2.0.10.1UnavailableNone listed
2.0.15affectedcustom2.0.15.1UnavailableNone listed
2.0.21affectedcustom2.0.21.1UnavailableNone listed
2.0.22affectedcustom2.0.22.1UnavailableNone listed
2.1.12affectedcustom2.1.12.1UnavailableNone listed
2.1affectedcustom2.1.1972UnavailableNone listed
2.2affectedcustom2.2.24UnavailableNone listed
2.2affectedcustom2.2.25UnavailableNone listed
3.1.0affectedcustom3.1.0.74UnavailableNone listed
3.3.6affectedcustom3.3.6.7UnavailableNone listed
3.3.26affectedcustom3.3.26.2UnavailableNone listed
3.3.35affectedcustom3.3.35.1UnavailableNone listed
3.3.41unaffectedcustomUnavailable*None listed

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util

Vendor
WSO2
Product
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.7.206affectedcustom6.7.206.567UnavailableNone listed
6.7.210affectedcustom6.7.210.63UnavailableNone listed
9.0.174affectedcustom9.0.174.522UnavailableNone listed
9.20.74affectedcustom9.20.74.379UnavailableNone listed
9.28.116affectedcustom9.28.116.360UnavailableNone listed
9.29.120affectedcustom9.29.120.184UnavailableNone listed
9.30.67affectedcustom9.30.67.109UnavailableNone listed
9.31.86affectedcustom9.31.86.71UnavailableNone listed
9.32.133unaffectedcustomUnavailable*None listed

org.wso2.carbon:org.wso2.carbon.base

Vendor
WSO2
Product
org.wso2.carbon:org.wso2.carbon.base
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon:org.wso2.carbon.base
org.wso2.carbon:org.wso2.carbon.base · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.4.7affectedcustom4.4.7.6UnavailableNone listed
4.4.9affectedcustom4.4.9.11UnavailableNone listed
4.4.11affectedcustom4.4.11.9UnavailableNone listed
4.4.26affectedcustom4.4.26.12UnavailableNone listed
4.4.35affectedcustom4.4.35.44UnavailableNone listed
4.5.1affectedcustom4.5.1.43UnavailableNone listed
4.6.0affectedcustom4.6.0.1990UnavailableNone listed
4.6.1affectedcustom4.6.1.149UnavailableNone listed
4.6.2affectedcustom4.6.2.667UnavailableNone listed
4.6.3affectedcustom4.6.3.36UnavailableNone listed
4.6.4affectedcustom4.6.4.14UnavailableNone listed
4.7.1affectedcustom4.7.1.68UnavailableNone listed
4.8.1affectedcustom4.8.1.39UnavailableNone listed
4.9.0affectedcustom4.9.0.99UnavailableNone listed
4.9.26affectedcustom4.9.26.25UnavailableNone listed
4.9.27affectedcustom4.9.27.10UnavailableNone listed
4.9.28affectedcustom4.9.28.11UnavailableNone listed
4.10.9affectedcustom4.10.9.66UnavailableNone listed
4.10.42affectedcustom4.10.42.9UnavailableNone listed
4.9affectedcustom4.9.29UnavailableNone listed
4.10affectedcustom4.10.94UnavailableNone listed

org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt

Vendor
WSO2
Product
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.2.0affectedcustom5.2.0.4UnavailableNone listed
5.2.2affectedcustom5.2.2.21UnavailableNone listed
5.7.5affectedcustom5.7.5.18UnavailableNone listed
5.11.148affectedcustom5.11.148.19UnavailableNone listed
5.11.256affectedcustom5.11.256.21UnavailableNone listed
5.12.153affectedcustom5.12.153.63UnavailableNone listed
5.12.387affectedcustom5.12.387.46UnavailableNone listed
5.14.97affectedcustom5.14.97.89UnavailableNone listed
5.17.5affectedcustom5.17.5.317UnavailableNone listed
5.17.118affectedcustom5.17.118.17UnavailableNone listed
5.18.187affectedcustom5.18.187.309UnavailableNone listed
5.18.248affectedcustom5.18.248.30UnavailableNone listed
5.23.8affectedcustom5.23.8.207UnavailableNone listed
5.24.8affectedcustom5.24.8.23UnavailableNone listed
5.25.92affectedcustom5.25.92.152UnavailableNone listed
5.25.705affectedcustom5.25.705.19UnavailableNone listed
5.25.713affectedcustom5.25.713.9UnavailableNone listed
5.25.724affectedcustom5.25.724.3UnavailableNone listed
7.0.78affectedcustom7.0.78.133UnavailableNone listed
7.8.23affectedcustom7.8.23.47UnavailableNone listed
5.25affectedcustom5.25.734UnavailableNone listed
7.8.489unaffectedcustomUnavailable*None listed

org.wso2.carbon:org.wso2.carbon.server.admin

Vendor
WSO2
Product
org.wso2.carbon:org.wso2.carbon.server.admin
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon:org.wso2.carbon.server.admin
org.wso2.carbon:org.wso2.carbon.server.admin · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.4.7affectedcustom4.4.7.6UnavailableNone listed
4.4.9affectedcustom4.4.9.11UnavailableNone listed
4.4.11affectedcustom4.4.11.9UnavailableNone listed
4.4.26affectedcustom4.4.26.12UnavailableNone listed
4.4.32affectedcustom4.4.32.16UnavailableNone listed
4.4.35affectedcustom4.4.35.44UnavailableNone listed
4.5.1affectedcustom4.5.1.43UnavailableNone listed
4.6.0affectedcustom4.6.0.1990UnavailableNone listed
4.6.1affectedcustom4.6.1.149UnavailableNone listed
4.6.2affectedcustom4.6.2.667UnavailableNone listed
4.6.3affectedcustom4.6.3.36UnavailableNone listed
4.6.4affectedcustom4.6.4.14UnavailableNone listed
4.7.1affectedcustom4.7.1.68UnavailableNone listed
4.8.1affectedcustom4.8.1.39UnavailableNone listed
4.9.0affectedcustom4.9.0.99UnavailableNone listed
4.9.26affectedcustom4.9.26.25UnavailableNone listed
4.9.27affectedcustom4.9.27.10UnavailableNone listed
4.9.28affectedcustom4.9.28.11UnavailableNone listed
4.10.9affectedcustom4.10.9.66UnavailableNone listed
4.10.42affectedcustom4.10.42.9UnavailableNone listed
4.9affectedcustom4.9.29UnavailableNone listed
4.10affectedcustom4.10.94UnavailableNone listed

org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow

Vendor
WSO2
Product
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.1.1affectedcustom5.1.1.1UnavailableNone listed
5.1.2affectedcustom5.1.2.1UnavailableNone listed
5.1.5affectedcustom5.1.5.1UnavailableNone listed
5.3.3affectedcustom5.3.3.1UnavailableNone listed
5.4.0affectedcustom5.4.0.4UnavailableNone listed
5.4.1affectedcustom5.4.1.5UnavailableNone listed
5.6.0affectedcustom5.6.0.1UnavailableNone listed
5.6.21unaffectedcustomUnavailable*None listed