Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

WSO2 Products: Unauthorized Access to Server Data

CVE-2025-9804 · published 1 year ago
Summary

A security flaw in WSO2 products allows a low-privileged user to access sensitive server information. This is a risk primarily for internal administrators, as it could lead to unauthorized data exposure. WSO2 users should review and update their permission settings to prevent this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wso2 api_control_plane 4.5.0
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*
wso2 api_manager 2.0.0
2.1.0
2.2.0
2.5.0
2.6.0
3.0.0
3.1.0
3.2.0
3.2.1
4.0.0
4.1.0
4.2.0
3 more version ranges
cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*
wso2 api_manager_analytics 2.0.0
2.1.0
2.2.0
2.5.0
cpe:2.3:a:wso2:api_manager_analytics:2.0.0:*:*:*:*:*:*:*
wso2 data_analytics_server 3.1.0
3.2.0
cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*
wso2 enterprise_integrator 6.2.0
6.3.0
cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*
wso2 enterprise_mobility_manager 2.2.0
cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:*
wso2 enterprise_service_bus 5.0.0
cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*
wso2 identity_server 5.2.0
5.3.0
5.4.0
5.4.1
5.5.0
5.6.0
5.7.0
5.8.0
5.9.0
5.10.0
5.11.0
6.0.0
3 more version ranges
cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*
wso2 identity_server_analytics 5.2.0
5.3.0
5.5.0
5.6.0
cpe:2.3:a:wso2:identity_server_analytics:5.2.0:*:*:*:*:*:*:*
wso2 identity_server_as_key_manager 5.3.0
5.5.0
5.6.0
5.7.0
5.9.0
5.10.0
cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*
wso2 open_banking_am 1.4.0
1.5.0
2.0.0
cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*
wso2 open_banking_iam 2.0.0
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
wso2 open_banking_km 1.4.0
1.5.0
cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*
wso2 traffic_manager 4.5.0
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*
wso2 universal_gateway 4.5.0
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*
Original advisory text
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged u...
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published16 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-9804 · NVD
Track software like this
Free during beta