CVE-2025-9804

CRITICAL
Published Oct 16, 2025 Modified Nov 21, 2025 CWE-284

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

CVSS v3.1 Score

9.6
CRITICAL
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-284 CWE-284

Affected Products

Vendor Product
wso2 api_control_plane
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager
wso2 api_manager_analytics
wso2 api_manager_analytics
wso2 api_manager_analytics
wso2 api_manager_analytics
wso2 data_analytics_server
wso2 data_analytics_server
wso2 enterprise_integrator
wso2 enterprise_integrator
wso2 enterprise_mobility_manager
wso2 enterprise_service_bus
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server
wso2 identity_server_analytics
wso2 identity_server_analytics
wso2 identity_server_analytics
wso2 identity_server_analytics
wso2 identity_server_as_key_manager
wso2 identity_server_as_key_manager
wso2 identity_server_as_key_manager
wso2 identity_server_as_key_manager
wso2 identity_server_as_key_manager
wso2 identity_server_as_key_manager
wso2 open_banking_am
wso2 open_banking_am
wso2 open_banking_am
wso2 open_banking_iam
wso2 open_banking_km
wso2 open_banking_km
wso2 traffic_manager
wso2 universal_gateway

References

Frequently Asked Questions

What is CVE-2025-9804? +
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. It has a CVSS v3.1 base score of 9.6 (CRITICAL).
How severe is CVE-2025-9804? +
CVE-2025-9804 has a CVSS v3.1 score of 9.6 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2025-9804? +
CVE-2025-9804 affects products from wso2, specifically: api_control_plane, api_manager, api_manager_analytics, data_analytics_server, enterprise_integrator, enterprise_mobility_manager, enterprise_service_bus, identity_server, identity_server_analytics, identity_server_as_key_manager, open_banking_am, open_banking_iam, open_banking_km, traffic_manager, universal_gateway. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-9804? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-9804 — free, no signup required.

Start Free Scan