CRITICAL🇵🇱 Wersja polska

CVE-2025-9804

CVSS 9.6v3.1pub. 2025-10-16upd. 2025-11-21

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Wso2 Api Control Plane
APP
Wso2
4.5.0
Wso2 Api Manager
APP
Wso2
2.0.02.1.02.2.02.5.02.6.03.0.03.1.03.2.03.2.14.0.04.1.04.2.04.3.04.4.04.5.0
Wso2 Api Manager Analytics
APP
Wso2
2.0.02.1.02.2.02.5.0
Wso2 Data Analytics Server
APP
Wso2
3.1.03.2.0
Wso2 Enterprise Integrator
APP
Wso2
6.2.06.3.0
Wso2 Enterprise Mobility Manager
APP
Wso2
2.2.0
Wso2 Enterprise Service Bus
APP
Wso2
5.0.0
Wso2 Identity Server
APP
Wso2
5.10.05.11.05.2.05.3.05.4.05.4.15.5.05.6.05.7.05.8.05.9.06.0.06.1.07.0.07.1.0
Wso2 Identity Server Analytics
APP
Wso2
5.2.05.3.05.5.05.6.0
Wso2 Identity Server As Key Manager
APP
Wso2
5.10.05.3.05.5.05.6.05.7.05.9.0
Wso2 Open Banking Am
APP
Wso2
1.4.01.5.02.0.0
Wso2 Open Banking Iam
APP
Wso2
2.0.0
Wso2 Open Banking Km
APP
Wso2
1.4.01.5.0
Wso2 Traffic Manager
APP
Wso2
4.5.0
Wso2 Universal Gateway
APP
Wso2
4.5.0