WSO2 Identity Server Analytics vulnerabilities

2 vulnerabilities

Known vulnerabilities in WSO2 Identity Server Analytics, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.6CVE-2025-9804wso2api_control_plane+34
EPSS score
0.56%
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.4.8CVE-2023-6911org.wso2.carbon.registrycarbon-registry+18
EPSS score
0.41%
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.