CVE-2025-9955

Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration

MEDIUM

5.7

CVSS Score

Published: October 16, 2025 at 12:14 PM UTC

Updated: October 18, 2026 at 09:10 PM UTC

4 products affected across 1 vendorEnterprise IntegratorEnterprise Service BusCarbon Base

Using WSO2 Enterprise Integrator by WSO2?

Get instant alerts when new vulnerabilities affect WSO2 Enterprise Integrator - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.7

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Enterprise Integrator · WSO2

95%

6.0.0 6.1.0 6.1.1 6.2.0 6.3.0 6.4.0 6.5.0 6.6.0

Affected range stops below 6.0.0.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.0.39, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.1.43, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.0.62, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.3.0.70, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.4.0.100, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.5.0.107, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.6.0.222, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.0.0 (unknown)

Enterprise Service Bus · WSO2

95%

5.0.0

Affected range stops below 5.0.0.29, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.0.0 (unknown)

Carbon Base · WSO2maven

90%

4.10 ≤ v < 4.10.944.4.14 ≤ v < 4.4.14.54.4.16 ≤ v < 4.4.16.94.4.26 ≤ v < 4.4.26.134.4.32 ≤ v < 4.4.32.164.4.36 ≤ v < 4.4.36.74.4.40 ≤ v < 4.4.40.374.4.8 ≤ v < 4.4.8.74.5.3 ≤ v < 4.5.3.454.9 ≤ v < 4.9.294.10 4.4.14 4.4.16 4.4.26 4.4.32 4.4.36 4.4.40 4.4.8 4.5.3 4.9

Affected range stops below 4.10.94, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.14.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.16.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.26.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.32.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.36.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.40.37, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.8.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.3.45, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.9.29, so it looks safe — our inference, not a vendor statement

Carbon Server Admin · WSO2maven