Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Summary
| CVE | CVE-2025-9804 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-16 13:15:42 UTC |
| Updated | 2026-09-26 00:10:00 UTC |
| Description | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.005590000 probability, percentile 0.443090000 (date 2026-09-27)
Problem Types: CWE-284 | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 9.6 | CRITICAL | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.6 | CRITICAL | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.9 | HIGH | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Wso2 | Api Control Plane | 4.5.0 | - | All | All |
| Application | Wso2 | Api Manager | 2.0.0 | All | All | All |
| Application | Wso2 | Api Manager | 2.1.0 | All | All | All |
| Application | Wso2 | Api Manager | 2.2.0 | All | All | All |
| Application | Wso2 | Api Manager | 2.5.0 | All | All | All |
| Application | Wso2 | Api Manager | 2.6.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.0.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.1.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.2.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.2.1 | All | All | All |
| Application | Wso2 | Api Manager | 4.0.0 | All | All | All |
| Application | Wso2 | Api Manager | 4.1.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.2.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.3.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.4.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.5.0 | - | All | All |
| Application | Wso2 | Api Manager Analytics | 2.0.0 | All | All | All |
| Application | Wso2 | Api Manager Analytics | 2.1.0 | All | All | All |
| Application | Wso2 | Api Manager Analytics | 2.2.0 | All | All | All |
| Application | Wso2 | Api Manager Analytics | 2.5.0 | All | All | All |
| Application | Wso2 | Data Analytics Server | 3.1.0 | All | All | All |
| Application | Wso2 | Data Analytics Server | 3.2.0 | All | All | All |
| Application | Wso2 | Enterprise Integrator | 6.2.0 | All | All | All |
| Application | Wso2 | Enterprise Integrator | 6.3.0 | All | All | All |
| Application | Wso2 | Enterprise Mobility Manager | 2.2.0 | All | All | All |
| Application | Wso2 | Enterprise Service Bus | 5.0.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.10.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.11.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.2.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.3.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.4.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.4.1 | All | All | All |
| Application | Wso2 | Identity Server | 5.5.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.6.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.7.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.8.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.9.0 | All | All | All |
| Application | Wso2 | Identity Server | 6.0.0 | - | All | All |
| Application | Wso2 | Identity Server | 6.1.0 | - | All | All |
| Application | Wso2 | Identity Server | 7.0.0 | - | All | All |
| Application | Wso2 | Identity Server | 7.1.0 | - | All | All |
| Application | Wso2 | Identity Server Analytics | 5.2.0 | All | All | All |
| Application | Wso2 | Identity Server Analytics | 5.3.0 | All | All | All |
| Application | Wso2 | Identity Server Analytics | 5.5.0 | All | All | All |
| Application | Wso2 | Identity Server Analytics | 5.6.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.10.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.3.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.5.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.6.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.7.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.9.0 | All | All | All |
| Application | Wso2 | Open Banking Am | 1.4.0 | All | All | All |
| Application | Wso2 | Open Banking Am | 1.5.0 | All | All | All |
| Application | Wso2 | Open Banking Am | 2.0.0 | All | All | All |
| Application | Wso2 | Open Banking Iam | 2.0.0 | All | All | All |
| Application | Wso2 | Open Banking Km | 1.4.0 | All | All | All |
| Application | Wso2 | Open Banking Km | 1.5.0 | All | All | All |
| Application | Wso2 | Traffic Manager | 4.5.0 | All | All | All |
| Application | Wso2 | Universal Gateway | 4.5.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.3.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.3.0 5.3.0.41 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.5.0 5.5.0.53 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.6.0 5.6.0.75 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.7.0 5.7.0.125 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.9.0 5.9.0.176 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.359 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | unknown 5.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.2.0 5.2.0.34 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.3.0 5.3.0.36 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.4.0 5.4.0.34 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.4.1 5.4.1.38 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.5.0 5.5.0.52 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.6.0 5.6.0.60 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.7.0 5.7.0.126 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.8.0 5.8.0.110 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.9.0 5.9.0.169 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.369 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.413 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.244 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.243 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.118 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.1.0 7.1.0.25 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking KM | unknown 1.4.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking KM | affected 1.4.0 1.4.0.133 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking KM | affected 1.5.0 1.5.0.123 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.409 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 1.4.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 1.4.0 1.4.0.139 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 1.5.0 1.5.0.140 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.389 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 2.0.0 2.0.0.31 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 2.1.0 2.1.0.40 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 2.2.0 2.2.0.59 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 2.5.0 2.5.0.85 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 2.6.0 2.6.0.146 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.0.0 3.0.0.176 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.340 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.441 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.61 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.361 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.224 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.162 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.75 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.4.0 4.4.0.39 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.5.0 4.5.0.23 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Analytics | unknown 5.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Analytics | affected 5.2.0 5.2.0.19 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Analytics | affected 5.3.0 5.3.0.17 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Analytics | affected 5.5.0 5.5.0.31 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Analytics | affected 5.6.0 5.6.0.38 custom | Not specified |
| CNA | WSO2 | API Manager Analytics | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | API Manager Analytics | affected 2.0.0 2.0.0.14 custom | Not specified |
| CNA | WSO2 | API Manager Analytics | affected 2.1.0 2.1.0.19 custom | Not specified |
| CNA | WSO2 | API Manager Analytics | affected 2.2.0 2.2.0.30 custom | Not specified |
| CNA | WSO2 | API Manager Analytics | affected 2.5.0 2.5.0.39 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | unknown 6.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | affected 6.2.0 6.2.0.62 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | affected 6.3.0 6.3.0.70 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Service Bus Analytics | unknown 5.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Service Bus Analytics | affected 5.0.0 5.0.0.13 custom | Not specified |
| CNA | WSO2 | WSO2 Data Analytics Server | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 Data Analytics Server | affected 3.1.0 3.1.0.20 custom | Not specified |
| CNA | WSO2 | WSO2 Data Analytics Server | affected 3.2.0 3.2.0.33 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Mobility Manager | unknown 2.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Mobility Manager | affected 2.2.0 2.2.0.28 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.5.0 4.5.0.22 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.5.0 4.5.0.24 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.5.0 4.5.0.22 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.0.10 2.0.10.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.0.15 2.0.15.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.0.21 2.0.21.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.0.22 2.0.22.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.1.12 2.1.12.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.1 2.1.1972 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.2 2.2.24 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 2.2 2.2.25 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 3.1.0 3.1.0.74 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 3.3.6 3.3.6.7 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 3.3.26 3.3.26.2 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | affected 3.3.35 3.3.35.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector | unaffected 3.3.41 * custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 6.7.206 6.7.206.567 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 6.7.210 6.7.210.63 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.0.174 9.0.174.522 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.20.74 9.20.74.379 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.28.116 9.28.116.360 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.29.120 9.29.120.184 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.30.67 9.30.67.109 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | affected 9.31.86 9.31.86.71 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util | unaffected 9.32.133 * custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.4.7 4.4.7.6 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.4.9 4.4.9.11 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.4.11 4.4.11.9 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.4.26 4.4.26.12 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.4.35 4.4.35.44 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.5.1 4.5.1.43 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.6.0 4.6.0.1990 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.6.1 4.6.1.149 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.6.2 4.6.2.667 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.6.3 4.6.3.36 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.6.4 4.6.4.14 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.7.1 4.7.1.68 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.8.1 4.8.1.39 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.9.0 4.9.0.99 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.9.26 4.9.26.25 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.9.27 4.9.27.10 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.9.28 4.9.28.11 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.10.9 4.10.9.66 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.10.42 4.10.42.9 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.9 4.9.29 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.base | affected 4.10 4.10.94 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.2.0 5.2.0.4 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.2.2 5.2.2.21 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.7.5 5.7.5.18 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.11.148 5.11.148.19 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.11.256 5.11.256.21 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.12.153 5.12.153.63 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.12.387 5.12.387.46 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.14.97 5.14.97.89 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.17.5 5.17.5.317 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.17.118 5.17.118.17 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.18.187 5.18.187.309 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.18.248 5.18.248.30 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.23.8 5.23.8.207 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.24.8 5.24.8.23 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.25.92 5.25.92.152 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.25.705 5.25.705.19 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.25.713 5.25.713.9 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.25.724 5.25.724.3 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 7.0.78 7.0.78.133 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 7.8.23 7.8.23.47 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | affected 5.25 5.25.734 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt | unaffected 7.8.489 * custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.7 4.4.7.6 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.9 4.4.9.11 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.11 4.4.11.9 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.26 4.4.26.12 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.32 4.4.32.16 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.4.35 4.4.35.44 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.5.1 4.5.1.43 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.6.0 4.6.0.1990 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.6.1 4.6.1.149 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.6.2 4.6.2.667 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.6.3 4.6.3.36 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.6.4 4.6.4.14 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.7.1 4.7.1.68 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.8.1 4.8.1.39 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.9.0 4.9.0.99 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.9.26 4.9.26.25 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.9.27 4.9.27.10 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.9.28 4.9.28.11 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.10.9 4.10.9.66 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.10.42 4.10.42.9 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.9 4.9.29 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbonorg.wso2.carbon.server.admin | affected 4.10 4.10.94 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.1.1 5.1.1.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.1.2 5.1.2.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.1.5 5.1.5.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.3.3 5.3.3.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.4.0 5.4.0.4 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.4.1 5.4.1.5 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | affected 5.6.0 5.6.0.1 custom | Not specified |
| CNA | WSO2 | Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow | unaffected 5.6.21 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: crnković (en)
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution
There are currently no legacy QID mappings associated with this CVE.