CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2025-9804
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_control_plane
- wso2:api_manager
- wso2:api_manager_analytics
- wso2:data_analytics_server
- wso2:enterprise_integrator
- wso2:enterprise_mobility_manager
- wso2:enterprise_service_bus
- wso2:identity_server
- wso2:identity_server_analytics
- wso2:identity_server_as_key_manager
- wso2:open_banking_am
- wso2:open_banking_iam
- wso2:open_banking_km
- wso2:traffic_manager
- wso2:universal_gateway