Paper/Archive/CVE-2025-9804

CVE-2025-9804

WSO2 WSO2 Identity Server as Key Manager — Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

EPSS 0.6%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 46.5.465 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

Affected

ProductAffectedFixed inSource

WSO2 Identity Server as Key Manager5.3.0 – < 5.3.0.415.3.0.41CNA

WSO2 Identity Server as Key Manager5.5.0 – < 5.5.0.535.5.0.53CNA

WSO2 Identity Server as Key Manager5.6.0 – < 5.6.0.755.6.0.75CNA

WSO2 Identity Server as Key Manager5.7.0 – < 5.7.0.1255.7.0.125CNA

WSO2 Identity Server as Key Manager5.9.0 – < 5.9.0.1765.9.0.176CNA

WSO2 Identity Server as Key Manager5.10.0 – < 5.10.0.3595.10.0.359CNA

WSO2 Identity Server5.2.0 – < 5.2.0.345.2.0.34CNA

WSO2 Identity Server5.3.0 – < 5.3.0.365.3.0.36CNA

WSO2 Identity Server5.4.0 – < 5.4.0.345.4.0.34CNA

WSO2 Identity Server5.4.1 – < 5.4.1.385.4.1.38CNA

WSO2 Identity Server5.5.0 – < 5.5.0.525.5.0.52CNA

WSO2 Identity Server5.6.0 – < 5.6.0.605.6.0.60CNA

Scores by source

WSO2 (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503