{"id":"CVE-2025-9804","title":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs","summary":"An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform una…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-284"],"vendor":"wso2","product":"api_control_plane","affected":["api_control_plane = 4.5.0","api_manager = 2.0.0","api_manager = 2.1.0","api_manager = 2.2.0","api_manager = 2.5.0","api_manager = 2.6.0","api_manager = 3.0.0","api_manager = 3.1.0","api_manager = 3.2.0","api_manager = 3.2.1","api_manager = 4.0.0","api_manager = 4.1.0","api_manager = 4.2.0","api_manager = 4.3.0","api_manager = 4.4.0","api_manager = 4.5.0","api_manager_analytics = 2.0.0","api_manager_analytics = 2.1.0","api_manager_analytics = 2.2.0","api_manager_analytics = 2.5.0","data_analytics_server = 3.1.0","data_analytics_server = 3.2.0","enterprise_integrator = 6.2.0","enterprise_integrator = 6.3.0","enterprise_mobility_manager = 2.2.0","enterprise_service_bus = 5.0.0","identity_server = 5.2.0","identity_server = 5.3.0","identity_server = 5.4.0","identity_server = 5.4.1","identity_server = 5.5.0","identity_server = 5.6.0","identity_server = 5.7.0","identity_server = 5.8.0","identity_server = 5.9.0","identity_server = 5.10.0","identity_server = 5.11.0","identity_server = 6.0.0","identity_server = 6.1.0","identity_server = 7.0.0","identity_server = 7.1.0","identity_server_analytics = 5.2.0","identity_server_analytics = 5.3.0","identity_server_analytics = 5.5.0","identity_server_analytics = 5.6.0","identity_server_as_key_manager = 5.3.0","identity_server_as_key_manager = 5.5.0","identity_server_as_key_manager = 5.6.0","identity_server_as_key_manager = 5.7.0","identity_server_as_key_manager = 5.9.0","identity_server_as_key_manager = 5.10.0","open_banking_am = 1.4.0","open_banking_am = 1.5.0","open_banking_am = 2.0.0","open_banking_iam = 2.0.0","open_banking_km = 1.4.0","open_banking_km = 1.5.0","traffic_manager = 4.5.0","universal_gateway = 4.5.0"],"published":"2025-10-16","updated":"2026-09-26","sourceUpdated":"2026-09-26T00:10:00.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9804","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/","label":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"tags":["nvd"],"epss":0.00559,"epssPercentile":0.4418,"ingestedAt":"2026-09-26T00:22:39.962Z","slug":"CVE-2025-9804","body":"## Overview\n\nAn improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.\n\n## Affected\n\n- `api_control_plane = 4.5.0`\n- `api_manager = 2.0.0`\n- `api_manager = 2.1.0`\n- `api_manager = 2.2.0`\n- `api_manager = 2.5.0`\n- `api_manager = 2.6.0`\n- `api_manager = 3.0.0`\n- `api_manager = 3.1.0`\n- `api_manager = 3.2.0`\n- `api_manager = 3.2.1`\n- `api_manager = 4.0.0`\n- `api_manager = 4.1.0`\n- `api_manager = 4.2.0`\n- `api_manager = 4.3.0`\n- `api_manager = 4.4.0`\n- `api_manager = 4.5.0`\n- `api_manager_analytics = 2.0.0`\n- `api_manager_analytics = 2.1.0`\n- `api_manager_analytics = 2.2.0`\n- `api_manager_analytics = 2.5.0`\n- `data_analytics_server = 3.1.0`\n- `data_analytics_server = 3.2.0`\n- `enterprise_integrator = 6.2.0`\n- `enterprise_integrator = 6.3.0`\n- `enterprise_mobility_manager = 2.2.0`\n- `enterprise_service_bus = 5.0.0`\n- `identity_server = 5.2.0`\n- `identity_server = 5.3.0`\n- `identity_server = 5.4.0`\n- `identity_server = 5.4.1`\n- `identity_server = 5.5.0`\n- `identity_server = 5.6.0`\n- `identity_server = 5.7.0`\n- `identity_server = 5.8.0`\n- `identity_server = 5.9.0`\n- `identity_server = 5.10.0`\n- `identity_server = 5.11.0`\n- `identity_server = 6.0.0`\n- `identity_server = 6.1.0`\n- `identity_server = 7.0.0`\n- `identity_server = 7.1.0`\n- `identity_server_analytics = 5.2.0`\n- `identity_server_analytics = 5.3.0`\n- `identity_server_analytics = 5.5.0`\n- `identity_server_analytics = 5.6.0`\n- `identity_server_as_key_manager = 5.3.0`\n- `identity_server_as_key_manager = 5.5.0`\n- `identity_server_as_key_manager = 5.6.0`\n- `identity_server_as_key_manager = 5.7.0`\n- `identity_server_as_key_manager = 5.9.0`\n- `identity_server_as_key_manager = 5.10.0`\n- `open_banking_am = 1.4.0`\n- `open_banking_am = 1.5.0`\n- `open_banking_am = 2.0.0`\n- `open_banking_iam = 2.0.0`\n- `open_banking_km = 1.4.0`\n- `open_banking_km = 1.5.0`\n- `traffic_manager = 4.5.0`\n- `universal_gateway = 4.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}