CVE-2025-9804Critical· 9.6▾ MidnightAn improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform una…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
api_control_plane = 4.5.0api_manager = 2.0.0api_manager = 2.1.0api_manager = 2.2.0api_manager = 2.5.0api_manager = 2.6.0api_manager = 3.0.0api_manager = 3.1.0api_manager = 3.2.0api_manager = 3.2.1api_manager = 4.0.0api_manager = 4.1.0api_manager = 4.2.0api_manager = 4.3.0api_manager = 4.4.0api_manager = 4.5.0api_manager_analytics = 2.0.0api_manager_analytics = 2.1.0api_manager_analytics = 2.2.0api_manager_analytics = 2.5.0data_analytics_server = 3.1.0data_analytics_server = 3.2.0enterprise_integrator = 6.2.0enterprise_integrator = 6.3.0enterprise_mobility_manager = 2.2.0enterprise_service_bus = 5.0.0identity_server = 5.2.0identity_server = 5.3.0identity_server = 5.4.0identity_server = 5.4.1identity_server = 5.5.0identity_server = 5.6.0identity_server = 5.7.0identity_server = 5.8.0identity_server = 5.9.0identity_server = 5.10.0identity_server = 5.11.0identity_server = 6.0.0identity_server = 6.1.0identity_server = 7.0.0identity_server = 7.1.0identity_server_analytics = 5.2.0identity_server_analytics = 5.3.0identity_server_analytics = 5.5.0identity_server_analytics = 5.6.0identity_server_as_key_manager = 5.3.0identity_server_as_key_manager = 5.5.0identity_server_as_key_manager = 5.6.0identity_server_as_key_manager = 5.7.0identity_server_as_key_manager = 5.9.0identity_server_as_key_manager = 5.10.0open_banking_am = 1.4.0open_banking_am = 1.5.0open_banking_am = 2.0.0open_banking_iam = 2.0.0open_banking_km = 1.4.0open_banking_km = 1.5.0traffic_manager = 4.5.0universal_gateway = 4.5.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-8154Medium· 5.3In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
CVE-2025-8325Medium· 6.3The software fails to enforce role-based access controls for certain Gateway API invocations
CVE-2025-9973Medium· 6.4Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser
CVE-2025-15039Critical· 9.4The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured
CVE-2025-13394Medium· 5.4The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks