CVE-2025-9804
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
Risk Assessment
The vulnerability affects only internal administrative interfaces; a low-privileged user may obtain server-level information or perform unauthorized administrative operations.
Recommendation
Apply available WSO2 updates, restrict access to internal administrative interfaces, and review permissions of low-privileged accounts.
Other vulnerabilities in WSO2 products
See all- CVE-2026-1728Critical
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.
- CVE-2022-29464CriticalActively exploited
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.
- CVE-2025-14260High
WSO2 Products have an improper implementation of access control rules, allowing malicious actors to perform a Server Side Request Forgery (SSRF) attack. Exploitation allows access to both internal and external resources available through the network or filesystem.
- CVE-2025-0663Medium
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key used across all tenants to sign authentication cookies allows a privileged user in one tenant to forge authentication cookies for users in other tenants.
- CVE-2025-5717Medium
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to SOAP admin services can deploy a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.
Original NVD description (English source)
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS