An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Thu, 16 Oct 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 16 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. | |
| Title | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2025-10-16T13:21:25.991Z
Reserved: 2025-09-01T13:11:12.678Z
Link: CVE-2025-9804
Vulnrichment
Updated: 2025-10-16T13:21:20.748Z
NVD
Status : Awaiting Analysis
Published: 2025-10-16T13:15:42.130
Modified: 2025-10-16T15:28:59.610
Link: CVE-2025-9804
Redhat
No data.
OpenCVE Enrichment
No data.