CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
MEDIUM
6.5
CVSS Score
Published: October 16, 2025 at 12:33 PM UTC
Updated: September 26, 2026 at 12:27 AM UTC
22 products affected across 1 vendorAPI ManagerIdentity ServerIdentity Server As Key Manager
Using WSO2 Identity Server as Key Manager by WSO2?
Get instant alerts when new vulnerabilities affect WSO2 Identity Server as Key Manager - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.6%
SSVC
No known exploit
Description
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
4.5.0 ≤ v < 4.5.0.244.5.0
Affected range stops below 4.5.0.24, so it looks safe — our inference, not a vendor statement
2.0.0 ≤ v < 2.0.0.312.1.0 ≤ v < 2.1.0.402.2.0 ≤ v < 2.2.0.592.5.0 ≤ v < 2.5.0.852.6.0 ≤ v < 2.6.0.1463.0.0 ≤ v < 3.0.0.1763.1.0 ≤ v < 3.1.0.3403.2.0 ≤ v < 3.2.0.4413.2.1 ≤ v < 3.2.1.614.0.0 ≤ v < 4.0.0.3614.1.0 ≤ v < 4.1.0.2244.2.0 ≤ v < 4.2.0.1624.3.0 ≤ v < 4.3.0.754.4.0 ≤ v < 4.4.0.394.5.0 ≤ v < 4.5.0.232.0.02.1.02.2.02.5.02.6.03.0.03.1.03.2.03.2.14.0.04.1.04.2.04.3.04.4.04.5.0
Affected range stops below 2.0.0.31, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.1.0.40, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.2.0.59, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.5.0.85, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.6.0.146, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.0.0.176, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.1.0.340, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0.441, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.1.61, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.0.0.361, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.1.0.224, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.2.0.162, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.3.0.75, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.4.0.39, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.5.0.23, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.0.0 (unknown)
2.0.0 ≤ v < 2.0.0.142.1.0 ≤ v < 2.1.0.192.2.0 ≤ v < 2.2.0.302.5.0 ≤ v < 2.5.0.392.0.02.1.02.2.02.5.0
Affected range stops below 2.0.0.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.1.0.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.2.0.30, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.5.0.39, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.0.0 (unknown)
Affected range stops below 3.1.0.20, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0.33, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 3.1.0 (unknown)
Affected range stops below 6.2.0.62, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.3.0.70, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.2.0 (unknown)
2.2.0 ≤ v < 2.2.0.282.2.0
Affected range stops below 2.2.0.28, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 2.2.0 (unknown)
5.10.0 ≤ v < 5.10.0.3695.11.0 ≤ v < 5.11.0.4135.2.0 ≤ v < 5.2.0.345.3.0 ≤ v < 5.3.0.365.4.0 ≤ v < 5.4.0.345.4.1 ≤ v < 5.4.1.385.5.0 ≤ v < 5.5.0.525.6.0 ≤ v < 5.6.0.605.7.0 ≤ v < 5.7.0.1265.8.0 ≤ v < 5.8.0.1105.9.0 ≤ v < 5.9.0.1696.0.0 ≤ v < 6.0.0.2446.1.0 ≤ v < 6.1.0.2437.0.0 ≤ v < 7.0.0.1187.1.0 ≤ v < 7.1.0.255.10.05.11.05.2.05.3.05.4.05.4.15.5.05.6.05.7.05.8.05.9.06.0.06.1.07.0.07.1.0
Affected range stops below 5.10.0.369, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.11.0.413, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.2.0.34, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.3.0.36, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.4.0.34, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.4.1.38, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.0.52, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.0.60, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7.0.126, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.8.0.110, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.9.0.169, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.0.0.244, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.1.0.243, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.0.0.118, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.1.0.25, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.2.0 (unknown)
5.2.0 ≤ v < 5.2.0.195.3.0 ≤ v < 5.3.0.175.5.0 ≤ v < 5.5.0.315.6.0 ≤ v < 5.6.0.385.2.05.3.05.5.05.6.0
Affected range stops below 5.2.0.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.3.0.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.0.31, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.0.38, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.2.0 (unknown)
5.10.0 ≤ v < 5.10.0.3595.3.0 ≤ v < 5.3.0.415.5.0 ≤ v < 5.5.0.535.6.0 ≤ v < 5.6.0.755.7.0 ≤ v < 5.7.0.1255.9.0 ≤ v < 5.9.0.1765.10.05.3.05.5.05.6.05.7.05.9.0
Affected range stops below 5.10.0.359, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.3.0.41, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.0.53, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.0.75, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7.0.125, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.9.0.176, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.3.0 (unknown)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
Vendor Advisory
Source: cverecord
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusANALYZED
CWE
CWE-284
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card