org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common vulnerabilities

CVEs whose affected-version data names the org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-10149High· 8.2

today

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user …

▾ TwilightWSO2 · WSO2 Identity Server as Key Managervia CVEORG