CVE-2025-9804

critical · 9.6

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

9.6

CVSS

0.6%

EPSS (exploit prob.)

45th

EPSS percentile

2025-10-16

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-284

Affected products

Vendor	Product	Affected versions
wso2	api_control_plane	4.5.0
wso2	api_manager	2.0.0
wso2	api_manager	2.1.0
wso2	api_manager	2.2.0
wso2	api_manager	2.5.0
wso2	api_manager	2.6.0
wso2	api_manager	3.0.0
wso2	api_manager	3.1.0
wso2	api_manager	3.2.0
wso2	api_manager	3.2.1
wso2	api_manager	4.0.0
wso2	api_manager	4.1.0
wso2	api_manager	4.2.0
wso2	api_manager	4.3.0
wso2	api_manager	4.4.0
wso2	api_manager	4.5.0
wso2	api_manager_analytics	2.0.0
wso2	api_manager_analytics	2.1.0
wso2	api_manager_analytics	2.2.0
wso2	api_manager_analytics	2.5.0
wso2	data_analytics_server	3.1.0
wso2	data_analytics_server	3.2.0
wso2	enterprise_integrator	6.2.0
wso2	enterprise_integrator	6.3.0
wso2	enterprise_mobility_manager	2.2.0
wso2	enterprise_service_bus	5.0.0
wso2	identity_server	5.2.0
wso2	identity_server	5.3.0
wso2	identity_server	5.4.0
wso2	identity_server	5.4.1
wso2	identity_server	5.5.0
wso2	identity_server	5.6.0
wso2	identity_server	5.7.0
wso2	identity_server	5.8.0
wso2	identity_server	5.9.0
wso2	identity_server	5.10.0
wso2	identity_server	5.11.0
wso2	identity_server	6.0.0
wso2	identity_server	6.1.0
wso2	identity_server	7.0.0

Check a specific version with /api/v1/cve/match.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-9804