CVE-2025-9804 – Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

CVE ID : CVE-2025-9804

Published : Oct. 16, 2025, 1:15 p.m. | 1 hour, 25 minutes ago

Description : An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager’s API Gateway remain unaffected.

Severity: 9.6 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…