WSO2 Fixes Two Critical Access Control Vulnerabilities (CVE-2025-9804, CVE-2025-10611) Affecting API Manager and Identity Server

WSO2 has released security advisories for two critical access control flaws, CVE-2025-9804 and CVE-2025-10611, that affect multiple enterprise products, including API Manager and Identity Server. CVE-2025-9804 has a CVSS score of 9.6 (Critical) and stems from improper access control across SOAP Admin Services and System REST APIs, potentially allowing a user with low privileges to perform unauthorized actions.

CVE-2025-10611 carries a CVSS of 9.8 (Critical) and involves broken authentication and authorization validation in System REST APIs, which could let attackers gain administrative access without valid credentials. Affected products include WSO2 API Manager (2.1.0–4.5.0), WSO2 Identity Server (5.3.0–7.1.0) and related components such as Identity Server as Key Manager, Open Banking AM and IAM, among others, with a note that APIs deployed through the API Gateway remain unaffected. WSO2 says fixes are available for both open-source and commercial users.