CVE-2025-9804: wso2 api_control_plane Improper Access Control

CVSS: 9.6v3.1CriticalAnalyzed

Published 16-10-2025Last modified 17-10-2025

Vulnerability summary

CVE-2025-9804 is a critical (CVSS 9.6) Improper Access Control vulnerability in wso2 api_control_plane. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.6/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.56%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

16-10-2025
PublishedVulnerability first disclosed.
17-10-2025
Last modifiedVulnerability information updated.

Description

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.6

EPSS trend

Probability

0.56%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

0.00 pp

From 0.56% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected systems

Wso235 products

api_control_plane4.5.0
api_manager2.0.0 | 2.1.0 | 2.2.0 | 2.5.0 | 2.6.0 | 3.0.0 | 3.1.0 | 3.2.0 | 3.2.1 | 4.0.0 | 4.1.0 | 4.2.0 | 4.3.0 | 4.4.0 | 4.5.0
api_manager_analytics≥ 2.0.0, < 2.0.0.14 | ≥ 2.1.0, < 2.1.0.19 | ≥ 2.2.0, < 2.2.0.30 | ≥ 2.5.0, < 2.5.0.39 | 2.0.0 | 2.1.0 | 2.2.0 | 2.5.0
data_analytics_server3.1.0 | 3.2.0
enterprise_integrator6.2.0 | 6.3.0

enterprise_mobility_manager2.2.0
enterprise_service_bus5.0.0
identity_server5.2.0 | 5.3.0 | 5.4.0 | 5.4.1 | 5.5.0 | 5.6.0 | 5.7.0 | 5.8.0 | 5.9.0 | 5.10.0 | 5.11.0 | 6.0.0 | 6.1.0 | 7.0.0 | 7.1.0
identity_server_analytics5.2.0 | 5.3.0 | 5.5.0 | 5.6.0
identity_server_as_key_manager5.3.0 | 5.5.0 | 5.6.0 | 5.7.0 | 5.9.0 | 5.10.0
open_banking_am1.4.0 | 1.5.0 | 2.0.0
open_banking_iam2.0.0
open_banking_km1.4.0 | 1.5.0
org.wso2.carbon:org.wso2.carbon.base≥ 4.4.7, < 4.4.7.6 | ≥ 4.4.9, < 4.4.9.11 | ≥ 4.4.11, < 4.4.11.9 | ≥ 4.4.26, < 4.4.26.12 | ≥ 4.4.35, < 4.4.35.44 | ≥ 4.5.1, < 4.5.1.43 | ≥ 4.6.0, < 4.6.0.1990 | ≥ 4.6.1, < 4.6.1.149 | ≥ 4.6.2, < 4.6.2.667 | ≥ 4.6.3, < 4.6.3.36 | ≥ 4.6.4, < 4.6.4.14 | ≥ 4.7.1, < 4.7.1.68 | ≥ 4.8.1, < 4.8.1.39 | ≥ 4.9.0, < 4.9.0.99 | ≥ 4.9.26, < 4.9.26.25 | ≥ 4.9.27, < 4.9.27.10 | ≥ 4.9.28, < 4.9.28.11 | ≥ 4.10.9, < 4.10.9.66 | ≥ 4.10.42, < 4.10.42.9 | ≥ 4.9, < 4.9.29 | ≥ 4.10, < 4.10.94
org.wso2.carbon:org.wso2.carbon.server.admin≥ 4.4.7, < 4.4.7.6 | ≥ 4.4.9, < 4.4.9.11 | ≥ 4.4.11, < 4.4.11.9 | ≥ 4.4.26, < 4.4.26.12 | ≥ 4.4.32, < 4.4.32.16 | ≥ 4.4.35, < 4.4.35.44 | ≥ 4.5.1, < 4.5.1.43 | ≥ 4.6.0, < 4.6.0.1990 | ≥ 4.6.1, < 4.6.1.149 | ≥ 4.6.2, < 4.6.2.667 | ≥ 4.6.3, < 4.6.3.36 | ≥ 4.6.4, < 4.6.4.14 | ≥ 4.7.1, < 4.7.1.68 | ≥ 4.8.1, < 4.8.1.39 | ≥ 4.9.0, < 4.9.0.99 | ≥ 4.9.26, < 4.9.26.25 | ≥ 4.9.27, < 4.9.27.10 | ≥ 4.9.28, < 4.9.28.11 | ≥ 4.10.9, < 4.10.9.66 | ≥ 4.10.42, < 4.10.42.9 | ≥ 4.9, < 4.9.29 | ≥ 4.10, < 4.10.94
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util≥ 6.7.206, < 6.7.206.567 | ≥ 6.7.210, < 6.7.210.63 | ≥ 9.0.174, < 9.0.174.522 | ≥ 9.20.74, < 9.20.74.379 | ≥ 9.28.116, < 9.28.116.360 | ≥ 9.29.120, < 9.29.120.184 | ≥ 9.30.67, < 9.30.67.109 | ≥ 9.31.86, < 9.31.86.71
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector≥ 2.0.10, < 2.0.10.1 | ≥ 2.0.15, < 2.0.15.1 | ≥ 2.0.21, < 2.0.21.1 | ≥ 2.0.22, < 2.0.22.1 | ≥ 2.1.12, < 2.1.12.1 | ≥ 2.1, < 2.1.1972 | ≥ 2.2, < 2.2.24 | ≥ 2.2, < 2.2.25 | ≥ 3.1.0, < 3.1.0.74 | ≥ 3.3.6, < 3.3.6.7 | ≥ 3.3.26, < 3.3.26.2 | ≥ 3.3.35, < 3.3.35.1
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt≥ 5.2.0, < 5.2.0.4 | ≥ 5.2.2, < 5.2.2.21 | ≥ 5.7.5, < 5.7.5.18 | ≥ 5.11.148, < 5.11.148.19 | ≥ 5.11.256, < 5.11.256.21 | ≥ 5.12.153, < 5.12.153.63 | ≥ 5.12.387, < 5.12.387.46 | ≥ 5.14.97, < 5.14.97.89 | ≥ 5.17.5, < 5.17.5.317 | ≥ 5.17.118, < 5.17.118.17 | ≥ 5.18.187, < 5.18.187.309 | ≥ 5.18.248, < 5.18.248.30 | ≥ 5.23.8, < 5.23.8.207 | ≥ 5.24.8, < 5.24.8.23 | ≥ 5.25.92, < 5.25.92.152 | ≥ 5.25.705, < 5.25.705.19 | ≥ 5.25.713, < 5.25.713.9 | ≥ 5.25.724, < 5.25.724.3 | ≥ 7.0.78, < 7.0.78.133 | ≥ 7.8.23, < 7.8.23.47 | ≥ 5.25, < 5.25.734
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow≥ 5.1.1, < 5.1.1.1 | ≥ 5.1.2, < 5.1.2.1 | ≥ 5.1.5, < 5.1.5.1 | ≥ 5.3.3, < 5.3.3.1 | ≥ 5.4.0, < 5.4.0.4 | ≥ 5.4.1, < 5.4.1.5 | ≥ 5.6.0, < 5.6.0.1
traffic_manager4.5.0
universal_gateway4.5.0
wso2 api control plane≥ 4.5.0, < 4.5.0.24
wso2 api manager≥ 2.0.0, < 2.0.0.31 | ≥ 2.1.0, < 2.1.0.40 | ≥ 2.2.0, < 2.2.0.59 | ≥ 2.5.0, < 2.5.0.85 | ≥ 2.6.0, < 2.6.0.146 | ≥ 3.0.0, < 3.0.0.176 | ≥ 3.1.0, < 3.1.0.340 | ≥ 3.2.0, < 3.2.0.441 | ≥ 3.2.1, < 3.2.1.61 | ≥ 4.0.0, < 4.0.0.361 | ≥ 4.1.0, < 4.1.0.224 | ≥ 4.2.0, < 4.2.0.162 | ≥ 4.3.0, < 4.3.0.75 | ≥ 4.4.0, < 4.4.0.39 | ≥ 4.5.0, < 4.5.0.23
wso2 data analytics server≥ 3.1.0, < 3.1.0.20 | ≥ 3.2.0, < 3.2.0.33
wso2 enterprise integrator≥ 6.2.0, < 6.2.0.62 | ≥ 6.3.0, < 6.3.0.70
wso2 enterprise mobility manager≥ 2.2.0, < 2.2.0.28
wso2 enterprise service bus analytics≥ 5.0.0, < 5.0.0.13
wso2 identity server≥ 5.2.0, < 5.2.0.34 | ≥ 5.3.0, < 5.3.0.36 | ≥ 5.4.0, < 5.4.0.34 | ≥ 5.4.1, < 5.4.1.38 | ≥ 5.5.0, < 5.5.0.52 | ≥ 5.6.0, < 5.6.0.60 | ≥ 5.7.0, < 5.7.0.126 | ≥ 5.8.0, < 5.8.0.110 | ≥ 5.9.0, < 5.9.0.169 | ≥ 5.10.0, < 5.10.0.369 | ≥ 5.11.0, < 5.11.0.413 | ≥ 6.0.0, < 6.0.0.244 | ≥ 6.1.0, < 6.1.0.243 | ≥ 7.0.0, < 7.0.0.118 | ≥ 7.1.0, < 7.1.0.25
wso2 identity server analytics≥ 5.2.0, < 5.2.0.19 | ≥ 5.3.0, < 5.3.0.17 | ≥ 5.5.0, < 5.5.0.31 | ≥ 5.6.0, < 5.6.0.38
wso2 identity server as key manager≥ 5.3.0, < 5.3.0.41 | ≥ 5.5.0, < 5.5.0.53 | ≥ 5.6.0, < 5.6.0.75 | ≥ 5.7.0, < 5.7.0.125 | ≥ 5.9.0, < 5.9.0.176 | ≥ 5.10.0, < 5.10.0.359
wso2 open banking am≥ 1.4.0, < 1.4.0.139 | ≥ 1.5.0, < 1.5.0.140 | ≥ 2.0.0, < 2.0.0.389
wso2 open banking iam≥ 2.0.0, < 2.0.0.409
wso2 open banking km≥ 1.4.0, < 1.4.0.133 | ≥ 1.5.0, < 1.5.0.123
wso2 traffic manager≥ 4.5.0, < 4.5.0.22
wso2 universal gateway≥ 4.5.0, < 4.5.0.22

Show all 35

1 vendor · 35 products

References

1 links

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/Vendor Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities