CVE-2025-9804
CRITICALDescription
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| wso2 | api_control_plane |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager |
| wso2 | api_manager_analytics |
| wso2 | api_manager_analytics |
| wso2 | api_manager_analytics |
| wso2 | api_manager_analytics |
| wso2 | data_analytics_server |
| wso2 | data_analytics_server |
| wso2 | enterprise_integrator |
| wso2 | enterprise_integrator |
| wso2 | enterprise_mobility_manager |
| wso2 | enterprise_service_bus |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server |
| wso2 | identity_server_analytics |
| wso2 | identity_server_analytics |
| wso2 | identity_server_analytics |
| wso2 | identity_server_analytics |
| wso2 | identity_server_as_key_manager |
| wso2 | identity_server_as_key_manager |
| wso2 | identity_server_as_key_manager |
| wso2 | identity_server_as_key_manager |
| wso2 | identity_server_as_key_manager |
| wso2 | identity_server_as_key_manager |
| wso2 | open_banking_am |
| wso2 | open_banking_am |
| wso2 | open_banking_am |
| wso2 | open_banking_iam |
| wso2 | open_banking_km |
| wso2 | open_banking_km |
| wso2 | traffic_manager |
| wso2 | universal_gateway |
References
Frequently Asked Questions
What is CVE-2025-9804? +
How severe is CVE-2025-9804? +
What products are affected by CVE-2025-9804? +
How do I check if I'm vulnerable to CVE-2025-9804? +
Related Vulnerabilities
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode …
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes …
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms …
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately …