{"api_version":"1","generated_at":"2026-10-14T23:57:25+00:00","cve":"CVE-2025-9804","urls":{"html":"https://cve.report/CVE-2025-9804","api":"https://cve.report/api/cve/CVE-2025-9804.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-9804","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-9804"},"summary":{"title":"Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs","description":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.","state":"PUBLISHED","assigner":"WSO2","published_at":"2025-10-16 13:15:42","updated_at":"2026-09-26 00:10:00"},"problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"9.6","severity":"CRITICAL","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.6","severity":"CRITICAL","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.9","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9804","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9804","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"unknown 5.3.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.3.0 5.3.0.41 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.5.0 5.5.0.53 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.6.0 5.6.0.75 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.7.0 5.7.0.125 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.9.0 5.9.0.176 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.10.0 5.10.0.359 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.2.0 5.2.0.34 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.3.0 5.3.0.36 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.4.0 5.4.0.34 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.4.1 5.4.1.38 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.5.0 5.5.0.52 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.6.0 5.6.0.60 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.7.0 5.7.0.126 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.8.0 5.8.0.110 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.9.0 5.9.0.169 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.10.0 5.10.0.369 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.413 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.244 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.243 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.118 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.1.0 7.1.0.25 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking KM","version":"unknown 1.4.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking KM","version":"affected 1.4.0 1.4.0.133 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking KM","version":"affected 1.5.0 1.5.0.123 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"affected 2.0.0 2.0.0.409 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"unknown 1.4.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 1.4.0 1.4.0.139 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 1.5.0 1.5.0.140 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 2.0.0 2.0.0.389 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 2.0.0 2.0.0.31 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 2.1.0 2.1.0.40 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 2.2.0 2.2.0.59 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 2.5.0 2.5.0.85 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 2.6.0 2.6.0.146 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.0.0 3.0.0.176 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.1.0 3.1.0.340 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.441 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.61 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.361 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.224 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.162 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.75 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.4.0 4.4.0.39 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.5.0 4.5.0.23 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server Analytics","version":"unknown 5.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server Analytics","version":"affected 5.2.0 5.2.0.19 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server Analytics","version":"affected 5.3.0 5.3.0.17 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server Analytics","version":"affected 5.5.0 5.5.0.31 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server Analytics","version":"affected 5.6.0 5.6.0.38 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"API Manager Analytics","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"API Manager Analytics","version":"affected 2.0.0 2.0.0.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"API Manager Analytics","version":"affected 2.1.0 2.1.0.19 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"API Manager Analytics","version":"affected 2.2.0 2.2.0.30 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"API Manager Analytics","version":"affected 2.5.0 2.5.0.39 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"unknown 6.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"affected 6.2.0 6.2.0.62 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"affected 6.3.0 6.3.0.70 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Service Bus Analytics","version":"unknown 5.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Service Bus Analytics","version":"affected 5.0.0 5.0.0.13 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Data Analytics Server","version":"unknown 3.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Data Analytics Server","version":"affected 3.1.0 3.1.0.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Data Analytics Server","version":"affected 3.2.0 3.2.0.33 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","version":"unknown 2.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Mobility Manager","version":"affected 2.2.0 2.2.0.28 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Universal Gateway","version":"affected 4.5.0 4.5.0.22 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Control Plane","version":"affected 4.5.0 4.5.0.24 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Traffic Manager","version":"affected 4.5.0 4.5.0.22 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.0.10 2.0.10.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.0.15 2.0.15.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.0.21 2.0.21.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.0.22 2.0.22.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.1.12 2.1.12.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.1 2.1.1972 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.2 2.2.24 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 2.2 2.2.25 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 3.1.0 3.1.0.74 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 3.3.6 3.3.6.7 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 3.3.26 3.3.26.2 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"affected 3.3.35 3.3.35.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","version":"unaffected 3.3.41 * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 6.7.206 6.7.206.567 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 6.7.210 6.7.210.63 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.0.174 9.0.174.522 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.20.74 9.20.74.379 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.28.116 9.28.116.360 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.29.120 9.29.120.184 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.30.67 9.30.67.109 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"affected 9.31.86 9.31.86.71 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","version":"unaffected 9.32.133 * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.4.7 4.4.7.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.4.9 4.4.9.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.4.11 4.4.11.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.4.26 4.4.26.12 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.4.35 4.4.35.44 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.5.1 4.5.1.43 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.6.0 4.6.0.1990 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.6.1 4.6.1.149 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.6.2 4.6.2.667 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.6.3 4.6.3.36 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.6.4 4.6.4.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.7.1 4.7.1.68 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.8.1 4.8.1.39 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.9.0 4.9.0.99 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.9.26 4.9.26.25 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.9.27 4.9.27.10 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.9.28 4.9.28.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.10.9 4.10.9.66 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.10.42 4.10.42.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.9 4.9.29 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.base","version":"affected 4.10 4.10.94 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.2.0 5.2.0.4 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.2.2 5.2.2.21 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.7.5 5.7.5.18 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.11.148 5.11.148.19 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.11.256 5.11.256.21 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.12.153 5.12.153.63 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.12.387 5.12.387.46 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.14.97 5.14.97.89 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.17.5 5.17.5.317 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.17.118 5.17.118.17 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.18.187 5.18.187.309 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.18.248 5.18.248.30 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.23.8 5.23.8.207 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.24.8 5.24.8.23 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.25.92 5.25.92.152 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.25.705 5.25.705.19 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.25.713 5.25.713.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.25.724 5.25.724.3 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 7.0.78 7.0.78.133 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 7.8.23 7.8.23.47 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"affected 5.25 5.25.734 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","version":"unaffected 7.8.489 * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.7 4.4.7.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.9 4.4.9.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.11 4.4.11.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.26 4.4.26.12 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.32 4.4.32.16 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.4.35 4.4.35.44 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.5.1 4.5.1.43 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.6.0 4.6.0.1990 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.6.1 4.6.1.149 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.6.2 4.6.2.667 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.6.3 4.6.3.36 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.6.4 4.6.4.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.7.1 4.7.1.68 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.8.1 4.8.1.39 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.9.0 4.9.0.99 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.9.26 4.9.26.25 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.9.27 4.9.27.10 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.9.28 4.9.28.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.10.9 4.10.9.66 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.10.42 4.10.42.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.9 4.9.29 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon:org.wso2.carbon.server.admin","version":"affected 4.10 4.10.94 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.1.1 5.1.1.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.1.2 5.1.2.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.1.5 5.1.5.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.3.3 5.3.3.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.4.0 5.4.0.4 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.4.1 5.4.1.5 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"affected 5.6.0 5.6.0.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","version":"unaffected 5.6.21 * custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"crnković","lang":"en"}],"nvd_cpes":[{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_control_plane","cpe6":"4.5.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"2.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"2.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"2.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"2.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"3.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"3.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"3.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.1.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.2.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.3.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.4.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager","cpe6":"4.5.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager_analytics","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager_analytics","cpe6":"2.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager_analytics","cpe6":"2.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"api_manager_analytics","cpe6":"2.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"data_analytics_server","cpe6":"3.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"data_analytics_server","cpe6":"3.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"enterprise_integrator","cpe6":"6.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"enterprise_integrator","cpe6":"6.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"enterprise_mobility_manager","cpe6":"2.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"enterprise_service_bus","cpe6":"5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"5.9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"6.0.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"6.1.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"7.0.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server","cpe6":"7.1.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_analytics","cpe6":"5.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_analytics","cpe6":"5.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_analytics","cpe6":"5.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_analytics","cpe6":"5.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"identity_server_as_key_manager","cpe6":"5.9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_am","cpe6":"1.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_am","cpe6":"1.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_am","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_iam","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_km","cpe6":"1.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"open_banking_km","cpe6":"1.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"traffic_manager","cpe6":"4.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"9804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wso2","cpe5":"universal_gateway","cpe6":"4.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"9804","cve":"CVE-2025-9804","epss":"0.005590000","percentile":"0.443090000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-9804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-10-16T13:20:20.582589Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-17T16:01:25.350Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.3.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.3.0.41","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.53","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.75","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.125","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.9.0.176","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.359","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.34","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.36","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.0.34","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.38","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.5.0.52","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.60","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.126","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.8.0.110","status":"affected","version":"5.8.0","versionType":"custom"},{"lessThan":"5.9.0.169","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.369","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.413","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.244","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.243","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.118","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.25","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking KM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.133","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.123","status":"affected","version":"1.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.409","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.139","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.140","status":"affected","version":"1.5.0","versionType":"custom"},{"lessThan":"2.0.0.389","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.31","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.40","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.59","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.85","status":"affected","version":"2.5.0","versionType":"custom"},{"lessThan":"2.6.0.146","status":"affected","version":"2.6.0","versionType":"custom"},{"lessThan":"3.0.0.176","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.1.0.340","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.441","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.61","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.361","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.224","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.162","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.75","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.39","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.23","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server Analytics","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.19","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.17","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.31","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.38","status":"affected","version":"5.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"API Manager Analytics","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.14","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.19","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.30","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.39","status":"affected","version":"2.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.2.0.62","status":"affected","version":"6.2.0","versionType":"custom"},{"lessThan":"6.3.0.70","status":"affected","version":"6.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Service Bus Analytics","vendor":"WSO2","versions":[{"lessThan":"5.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.0.0.13","status":"affected","version":"5.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Data Analytics Server","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.20","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.33","status":"affected","version":"3.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Mobility Manager","vendor":"WSO2","versions":[{"lessThan":"2.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.2.0.28","status":"affected","version":"2.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.24","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","vendor":"WSO2","versions":[{"lessThan":"2.0.10.1","status":"affected","version":"2.0.10","versionType":"custom"},{"lessThan":"2.0.15.1","status":"affected","version":"2.0.15","versionType":"custom"},{"lessThan":"2.0.21.1","status":"affected","version":"2.0.21","versionType":"custom"},{"lessThan":"2.0.22.1","status":"affected","version":"2.0.22","versionType":"custom"},{"lessThan":"2.1.12.1","status":"affected","version":"2.1.12","versionType":"custom"},{"lessThan":"2.1.1972","status":"affected","version":"2.1","versionType":"custom"},{"lessThan":"2.2.24","status":"affected","version":"2.2","versionType":"custom"},{"lessThan":"2.2.25","status":"affected","version":"2.2","versionType":"custom"},{"lessThan":"3.1.0.74","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.3.6.7","status":"affected","version":"3.3.6","versionType":"custom"},{"lessThan":"3.3.26.2","status":"affected","version":"3.3.26","versionType":"custom"},{"lessThan":"3.3.35.1","status":"affected","version":"3.3.35","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"3.3.41","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","vendor":"WSO2","versions":[{"lessThan":"6.7.206.567","status":"affected","version":"6.7.206","versionType":"custom"},{"lessThan":"6.7.210.63","status":"affected","version":"6.7.210","versionType":"custom"},{"lessThan":"9.0.174.522","status":"affected","version":"9.0.174","versionType":"custom"},{"lessThan":"9.20.74.379","status":"affected","version":"9.20.74","versionType":"custom"},{"lessThan":"9.28.116.360","status":"affected","version":"9.28.116","versionType":"custom"},{"lessThan":"9.29.120.184","status":"affected","version":"9.29.120","versionType":"custom"},{"lessThan":"9.30.67.109","status":"affected","version":"9.30.67","versionType":"custom"},{"lessThan":"9.31.86.71","status":"affected","version":"9.31.86","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"9.32.133","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.base","product":"org.wso2.carbon:org.wso2.carbon.base","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.35.44","status":"affected","version":"4.4.35","versionType":"custom"},{"lessThan":"4.5.1.43","status":"affected","version":"4.5.1","versionType":"custom"},{"lessThan":"4.6.0.1990","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.149","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.667","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.36","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.14","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.68","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.39","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.99","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.25","status":"affected","version":"4.9.26","versionType":"custom"},{"lessThan":"4.9.27.10","status":"affected","version":"4.9.27","versionType":"custom"},{"lessThan":"4.9.28.11","status":"affected","version":"4.9.28","versionType":"custom"},{"lessThan":"4.10.9.66","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.10.42.9","status":"affected","version":"4.10.42","versionType":"custom"},{"lessThan":"4.9.29","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.10.94","status":"affected","version":"4.10","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","vendor":"WSO2","versions":[{"lessThan":"5.2.0.4","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.2.2.21","status":"affected","version":"5.2.2","versionType":"custom"},{"lessThan":"5.7.5.18","status":"affected","version":"5.7.5","versionType":"custom"},{"lessThan":"5.11.148.19","status":"affected","version":"5.11.148","versionType":"custom"},{"lessThan":"5.11.256.21","status":"affected","version":"5.11.256","versionType":"custom"},{"lessThan":"5.12.153.63","status":"affected","version":"5.12.153","versionType":"custom"},{"lessThan":"5.12.387.46","status":"affected","version":"5.12.387","versionType":"custom"},{"lessThan":"5.14.97.89","status":"affected","version":"5.14.97","versionType":"custom"},{"lessThan":"5.17.5.317","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.17.118.17","status":"affected","version":"5.17.118","versionType":"custom"},{"lessThan":"5.18.187.309","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.18.248.30","status":"affected","version":"5.18.248","versionType":"custom"},{"lessThan":"5.23.8.207","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.24.8.23","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.92.152","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.705.19","status":"affected","version":"5.25.705","versionType":"custom"},{"lessThan":"5.25.713.9","status":"affected","version":"5.25.713","versionType":"custom"},{"lessThan":"5.25.724.3","status":"affected","version":"5.25.724","versionType":"custom"},{"lessThan":"7.0.78.133","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThan":"7.8.23.47","status":"affected","version":"7.8.23","versionType":"custom"},{"lessThan":"5.25.734","status":"affected","version":"5.25","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.8.489","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.server.admin","product":"org.wso2.carbon:org.wso2.carbon.server.admin","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.32.16","status":"affected","version":"4.4.32","versionType":"custom"},{"lessThan":"4.4.35.44","status":"affected","version":"4.4.35","versionType":"custom"},{"lessThan":"4.5.1.43","status":"affected","version":"4.5.1","versionType":"custom"},{"lessThan":"4.6.0.1990","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.149","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.667","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.36","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.14","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.68","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.39","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.99","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.25","status":"affected","version":"4.9.26","versionType":"custom"},{"lessThan":"4.9.27.10","status":"affected","version":"4.9.27","versionType":"custom"},{"lessThan":"4.9.28.11","status":"affected","version":"4.9.28","versionType":"custom"},{"lessThan":"4.10.9.66","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.10.42.9","status":"affected","version":"4.10.42","versionType":"custom"},{"lessThan":"4.9.29","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.10.94","status":"affected","version":"4.10","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","vendor":"WSO2","versions":[{"lessThan":"5.1.1.1","status":"affected","version":"5.1.1","versionType":"custom"},{"lessThan":"5.1.2.1","status":"affected","version":"5.1.2","versionType":"custom"},{"lessThan":"5.1.5.1","status":"affected","version":"5.1.5","versionType":"custom"},{"lessThan":"5.3.3.1","status":"affected","version":"5.3.3","versionType":"custom"},{"lessThan":"5.4.0.4","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.5","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.6.0.1","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"5.6.21","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"crnković"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.<br><br>This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.<br>"}],"value":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"For WSO2 API Manager"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"For WSO2 Identity Server"}]}],"providerMetadata":{"dateUpdated":"2025-10-16T12:33:45.426Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution</span></a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"}],"source":{"advisory":"WSO2-2025-4503","discovery":"EXTERNAL"},"title":"Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2025-9804","datePublished":"2025-10-16T12:33:45.426Z","dateReserved":"2025-09-01T13:11:12.678Z","dateUpdated":"2025-10-17T16:01:25.350Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2025-10-16 13:15:42","lastModifiedDate":"2026-09-26 00:10:00","problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-16T13:20:20.582589Z","id":"CVE-2025-9804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*","matchCriteriaId":"DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"C6D7E912-B0C4-4AD2-90CF-6355BA9DEEB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"245D4EB1-F69D-4FAF-94DB-F4B3D3C20539"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"6819491F-C6C3-41C1-B27A-0D0B62224977"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*","matchCriteriaId":"0D57C8CF-084D-4142-9AF1-7C9F1261A3BD"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"BC168B6A-B15A-4C3B-A38D-C0B65F24F333"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"8FF14774-8935-4FC9-B5C8-9771B3D6EBFD"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*","matchCriteriaId":"1344FB79-0796-445C-A8F3-C03E995925D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*","matchCriteriaId":"E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*","matchCriteriaId":"B58251E8-606B-47C8-8E50-9F9FC8C179BD"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*","matchCriteriaId":"E21D7ABF-C328-425D-B914-618C7628220B"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*","matchCriteriaId":"51465410-6B7C-40FD-A1AB-A14F650A6AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*","matchCriteriaId":"851470CC-22AB-43E4-9CC6-5E22D49B3572"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*","matchCriteriaId":"9EBAB99E-6F0F-4CE9-A954-E8878826304C"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*","matchCriteriaId":"0B3E6207-B2CF-487C-9CB8-906248B665C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*","matchCriteriaId":"D47B760D-5418-4FB0-88F0-3F78BAFF63E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager_analytics:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"2318B757-4BE3-4A45-9337-12281210964E"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager_analytics:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"2D5DF76F-1578-4C10-AB38-A01979302B3B"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"ADEAF56C-4583-40A6-826F-01AC86191AD7"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*","matchCriteriaId":"04A2A50A-872E-4CC7-BBB7-3E0956176AAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*","matchCriteriaId":"941D83A5-1978-49AE-890D-E31980E2D6AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:*","matchCriteriaId":"5CCDDFAB-C8FC-41C4-9872-667C442F119B"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*","matchCriteriaId":"66292C25-B0B9-4FCE-9382-57B8F6BB814A"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*","matchCriteriaId":"709DC7EA-18A6-4B83-84CB-F2499BEB5D2F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"A9D6FCEF-7685-42DD-B322-AD87B5F37574"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"236C44E3-FAB5-41F2-9884-D17944EBB468"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*","matchCriteriaId":"2689AF3E-01AA-4B79-BA55-6BB3D81E16CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*","matchCriteriaId":"0375C318-ECD2-4657-A0D7-4A0708266FBE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"B9E7D773-A7CE-4AB8-828B-C2E7DC2799AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*","matchCriteriaId":"CEA63B98-D4B4-4FCD-A869-FE64BC21A1B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*","matchCriteriaId":"8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*","matchCriteriaId":"26542F95-73F3-4906-838E-A66F5DC9DFA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*","matchCriteriaId":"60781FE4-38A3-4FEA-9D8B-CADE4B535974"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*","matchCriteriaId":"2B169832-A746-49A6-8E92-06624AA9B13A"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*","matchCriteriaId":"981D701D-E381-484A-9614-CD0EF0331071"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*","matchCriteriaId":"F4F126CA-A2F9-44F4-968B-DF71765869E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*","matchCriteriaId":"2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*","matchCriteriaId":"32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*","matchCriteriaId":"EA76533A-5BED-4BDC-B348-EB3D3FDFB110"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*","matchCriteriaId":"C1EFBD0F-9664-4EF3-9908-C72B1318F68F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*","matchCriteriaId":"A5358E6E-8C01-408D-8692-B1A326DC630F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_analytics:5.2.0:*:*:*:*:*:*:*","matchCriteriaId":"A1116722-BC4A-4127-9BF5-DB62760BD026"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_analytics:5.3.0:*:*:*:*:*:*:*","matchCriteriaId":"D1AB6D32-5BD3-47F0-BDA8-3AEC1C24543F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*","matchCriteriaId":"42BFE7A0-A168-4C1E-8725-41DD500C837E"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*","matchCriteriaId":"5508EC5E-BEEA-49A7-BA2E-AEF40ECCB5C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*","matchCriteriaId":"104DBA04-538E-4CC5-9B6C-CFEDB40375AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*","matchCriteriaId":"E4F0F121-700C-4D30-BAFC-960DCC56F08B"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*","matchCriteriaId":"2E5761F7-C287-4EC4-A899-C54FB4E80A35"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*","matchCriteriaId":"3B184BFC-8E1A-4971-B6D2-C594742AB8CE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*","matchCriteriaId":"EA51AC1B-0BF6-44F6-B034-CAD4F623DD76"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*","matchCriteriaId":"6BB34405-A2F1-461A-B51B-E103BB3680A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"8CFB56F4-91D1-4FBF-842A-04BB117CAF85"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"035BF3B3-1AB9-43BC-BB37-68843818EDEA"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"94347800-04D2-48C4-ACF0-078A5ACBB063"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"E53783F4-60C7-4A92-8951-F8FD51170670"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"535EFD44-F81C-43B2-B595-81429468637F"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*","matchCriteriaId":"C7413107-D7B2-49AE-AC46-52E7BFCD6ED8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*","matchCriteriaId":"61636553-C25E-44DF-93D7-EB3E1056D1DC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"9804","Ordinal":"1","Title":"Improper Access Control in Multiple WSO2 Products via Internal S","CVE":"CVE-2025-9804","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"9804","Ordinal":"1","NoteData":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.","Type":"Description","Title":"Improper Access Control in Multiple WSO2 Products via Internal S"}]}}}