---
id: CVE-2025-9804
title: >-
  An improper access control vulnerability exists in multiple WSO2 products due
  to insufficient permission enforcement in certain internal SOAP Admin Services
  and System REST APIs
summary: >-
  An improper access control vulnerability exists in multiple WSO2 products due
  to insufficient permission enforcement in certain internal SOAP Admin Services
  and System REST APIs. A low-privileged user may exploit this flaw to perform
  una…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-284
vendor: wso2
product: api_control_plane
affected:
  - api_control_plane = 4.5.0
  - api_manager = 2.0.0
  - api_manager = 2.1.0
  - api_manager = 2.2.0
  - api_manager = 2.5.0
  - api_manager = 2.6.0
  - api_manager = 3.0.0
  - api_manager = 3.1.0
  - api_manager = 3.2.0
  - api_manager = 3.2.1
  - api_manager = 4.0.0
  - api_manager = 4.1.0
  - api_manager = 4.2.0
  - api_manager = 4.3.0
  - api_manager = 4.4.0
  - api_manager = 4.5.0
  - api_manager_analytics = 2.0.0
  - api_manager_analytics = 2.1.0
  - api_manager_analytics = 2.2.0
  - api_manager_analytics = 2.5.0
  - data_analytics_server = 3.1.0
  - data_analytics_server = 3.2.0
  - enterprise_integrator = 6.2.0
  - enterprise_integrator = 6.3.0
  - enterprise_mobility_manager = 2.2.0
  - enterprise_service_bus = 5.0.0
  - identity_server = 5.2.0
  - identity_server = 5.3.0
  - identity_server = 5.4.0
  - identity_server = 5.4.1
  - identity_server = 5.5.0
  - identity_server = 5.6.0
  - identity_server = 5.7.0
  - identity_server = 5.8.0
  - identity_server = 5.9.0
  - identity_server = 5.10.0
  - identity_server = 5.11.0
  - identity_server = 6.0.0
  - identity_server = 6.1.0
  - identity_server = 7.0.0
  - identity_server = 7.1.0
  - identity_server_analytics = 5.2.0
  - identity_server_analytics = 5.3.0
  - identity_server_analytics = 5.5.0
  - identity_server_analytics = 5.6.0
  - identity_server_as_key_manager = 5.3.0
  - identity_server_as_key_manager = 5.5.0
  - identity_server_as_key_manager = 5.6.0
  - identity_server_as_key_manager = 5.7.0
  - identity_server_as_key_manager = 5.9.0
  - identity_server_as_key_manager = 5.10.0
  - open_banking_am = 1.4.0
  - open_banking_am = 1.5.0
  - open_banking_am = 2.0.0
  - open_banking_iam = 2.0.0
  - open_banking_km = 1.4.0
  - open_banking_km = 1.5.0
  - traffic_manager = 4.5.0
  - universal_gateway = 4.5.0
published: '2025-10-16'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T00:10:00.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-9804'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
tags:
  - nvd
epss: 0.00559
epssPercentile: 0.4418
ingestedAt: '2026-09-26T00:22:39.962Z'
---

## Overview

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

## Affected

- `api_control_plane = 4.5.0`
- `api_manager = 2.0.0`
- `api_manager = 2.1.0`
- `api_manager = 2.2.0`
- `api_manager = 2.5.0`
- `api_manager = 2.6.0`
- `api_manager = 3.0.0`
- `api_manager = 3.1.0`
- `api_manager = 3.2.0`
- `api_manager = 3.2.1`
- `api_manager = 4.0.0`
- `api_manager = 4.1.0`
- `api_manager = 4.2.0`
- `api_manager = 4.3.0`
- `api_manager = 4.4.0`
- `api_manager = 4.5.0`
- `api_manager_analytics = 2.0.0`
- `api_manager_analytics = 2.1.0`
- `api_manager_analytics = 2.2.0`
- `api_manager_analytics = 2.5.0`
- `data_analytics_server = 3.1.0`
- `data_analytics_server = 3.2.0`
- `enterprise_integrator = 6.2.0`
- `enterprise_integrator = 6.3.0`
- `enterprise_mobility_manager = 2.2.0`
- `enterprise_service_bus = 5.0.0`
- `identity_server = 5.2.0`
- `identity_server = 5.3.0`
- `identity_server = 5.4.0`
- `identity_server = 5.4.1`
- `identity_server = 5.5.0`
- `identity_server = 5.6.0`
- `identity_server = 5.7.0`
- `identity_server = 5.8.0`
- `identity_server = 5.9.0`
- `identity_server = 5.10.0`
- `identity_server = 5.11.0`
- `identity_server = 6.0.0`
- `identity_server = 6.1.0`
- `identity_server = 7.0.0`
- `identity_server = 7.1.0`
- `identity_server_analytics = 5.2.0`
- `identity_server_analytics = 5.3.0`
- `identity_server_analytics = 5.5.0`
- `identity_server_analytics = 5.6.0`
- `identity_server_as_key_manager = 5.3.0`
- `identity_server_as_key_manager = 5.5.0`
- `identity_server_as_key_manager = 5.6.0`
- `identity_server_as_key_manager = 5.7.0`
- `identity_server_as_key_manager = 5.9.0`
- `identity_server_as_key_manager = 5.10.0`
- `open_banking_am = 1.4.0`
- `open_banking_am = 1.5.0`
- `open_banking_am = 2.0.0`
- `open_banking_iam = 2.0.0`
- `open_banking_km = 1.4.0`
- `open_banking_km = 1.5.0`
- `traffic_manager = 4.5.0`
- `universal_gateway = 4.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.