CVE-2025-9804: Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
WSO2 · WSO2 Identity Server as Key Manager
Vendor fix available · Affected: WSO2 Identity Server as Key Manager · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 47% of scored CVEs
DescriptionCVE.org
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Affected products20
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- WSO2 · WSO2 Identity Server as Key Managerfrom 5.3.0 before 5.3.0.41; from 5.5.0 before 5.5.0.53; from 5.6.0 before 5.6.0.75; from 5.7.0 before 5.7.0.125; from 5.9.0 before 5.9.0.176; from 5.10.0 before 5.10.0.359
- WSO2 · WSO2 Identity Serverfrom 5.2.0 before 5.2.0.34; from 5.3.0 before 5.3.0.36; from 5.4.0 before 5.4.0.34; from 5.4.1 before 5.4.1.38; from 5.5.0 before 5.5.0.52; from 5.6.0 before 5.6.0.60 and 9 more
- WSO2 · WSO2 Open Banking KMfrom 1.4.0 before 1.4.0.133; from 1.5.0 before 1.5.0.123
- WSO2 · WSO2 Open Banking IAMfrom 2.0.0 before 2.0.0.409
- WSO2 · WSO2 Open Banking AMfrom 1.4.0 before 1.4.0.139; from 1.5.0 before 1.5.0.140; from 2.0.0 before 2.0.0.389
- WSO2 · WSO2 API Managerfrom 2.0.0 before 2.0.0.31; from 2.1.0 before 2.1.0.40; from 2.2.0 before 2.2.0.59; from 2.5.0 before 2.5.0.85; from 2.6.0 before 2.6.0.146; from 3.0.0 before 3.0.0.176 and 9 more
- WSO2 · WSO2 Identity Server Analyticsfrom 5.2.0 before 5.2.0.19; from 5.3.0 before 5.3.0.17; from 5.5.0 before 5.5.0.31; from 5.6.0 before 5.6.0.38
- WSO2 · API Manager Analyticsfrom 2.0.0 before 2.0.0.14; from 2.1.0 before 2.1.0.19; from 2.2.0 before 2.2.0.30; from 2.5.0 before 2.5.0.39
- WSO2 · WSO2 Enterprise Integratorfrom 6.2.0 before 6.2.0.62; from 6.3.0 before 6.3.0.70
- WSO2 · WSO2 Enterprise Service Bus Analyticsfrom 5.0.0 before 5.0.0.13
- WSO2 · WSO2 Data Analytics Serverfrom 3.1.0 before 3.1.0.20; from 3.2.0 before 3.2.0.33
- WSO2 · WSO2 Enterprise Mobility Managerfrom 2.2.0 before 2.2.0.28
- WSO2 · WSO2 Universal Gatewayfrom 4.5.0 before 4.5.0.22
- WSO2 · WSO2 API Control Planefrom 4.5.0 before 4.5.0.24
- WSO2 · WSO2 Traffic Managerfrom 4.5.0 before 4.5.0.22
- WSO2 · org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.co…from 2.0.10 before 2.0.10.1; from 2.0.15 before 2.0.15.1; from 2.0.21 before 2.0.21.1; from 2.0.22 before 2.0.22.1; from 2.1.12 before 2.1.12.1; from 2.1 before 2.1.1972 and 6 more
- WSO2 · org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.utilfrom 6.7.206 before 6.7.206.567; from 6.7.210 before 6.7.210.63; from 9.0.174 before 9.0.174.522; from 9.20.74 before 9.20.74.379; from 9.28.116 before 9.28.116.360; from 9.29.120 before 9.29.120.184 and 2 more
- WSO2 · org.wso2.carbon:org.wso2.carbon.basefrom 4.4.7 before 4.4.7.6; from 4.4.9 before 4.4.9.11; from 4.4.11 before 4.4.11.9; from 4.4.26 before 4.4.26.12; from 4.4.35 before 4.4.35.44; from 4.5.1 before 4.5.1.43 and 15 more
- WSO2 · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgtfrom 5.2.0 before 5.2.0.4; from 5.2.2 before 5.2.2.21; from 5.7.5 before 5.7.5.18; from 5.11.148 before 5.11.148.19; from 5.11.256 before 5.11.256.21; from 5.12.153 before 5.12.153.63 and 15 more
- WSO2 · org.wso2.carbon:org.wso2.carbon.server.adminfrom 4.4.7 before 4.4.7.6; from 4.4.9 before 4.4.9.11; from 4.4.11 before 4.4.11.9; from 4.4.26 before 4.4.26.12; from 4.4.32 before 4.4.32.16; from 4.4.35 before 4.4.35.44 and 16 more
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- WSO2
- Published
- October 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-9804 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.