Description
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment.
Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Metrics
CVSS 3.1 5.4/10
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Open Banking IAM | >= 2.0.0, < 2.0.0.364 |
| WSO2 | WSO2 Open Banking AM | >= 1.3.0, < 1.3.0.131; >= 1.4.0, < 1.4.0.134; >= 1.5.0, < 1.5.0.136; >= 2.0.0, < 2.0.0.343 |
| WSO2 | WSO2 API Manager | >= 2.0.0, < 2.0.0.29; >= 2.1.0, < 2.1.0.39; >= 2.2.0, < 2.2.0.56; >= 2.5.0, < 2.5.0.83; >= 2.6.0, < 2.6.0.142; >= 3.0.0, < 3.0.0.162; >= 3.1.0, < 3.1.0.294; >= 3.2.0, < 3.2.0.384; >= 3.2.1, < 3.2.1.16; >= 4.0.0, < 4.0.0.305; >= 4.1.0, < 4.1.0.166; >= 4.2.0, < 4.2.0.101; >= 4.3.0, < 4.3.0.16 |
| WSO2 | WSO2 Enterprise Mobility Manager | >= 2.2.0, < 2.2.0.26 |
| WSO2 | WSO2 Identity Server | >= 5.2.0, < 5.2.0.32; >= 5.3.0, < 5.3.0.33; >= 5.4.1, < 5.4.1.36; >= 5.5.0, < 5.5.0.50; >= 5.6.0, < 5.6.0.58; >= 5.7.0, < 5.7.0.123; >= 5.8.0, < 5.8.0.106; >= 5.9.0, < 5.9.0.157; >= 5.10.0, < 5.10.0.318; >= 5.11.0, < 5.11.0.365; >= 6.0.0, < 6.0.0.209; >= 6.1.0, < 6.1.0.188; >= 7.0.0, < 7.0.0.60 |
| WSO2 | WSO2 Identity Server as Key Manager | >= 5.3.0, < 5.3.0.38; >= 5.5.0, < 5.5.0.51; >= 5.6.0, < 5.6.0.72; >= 5.7.0, < 5.7.0.122; >= 5.9.0, < 5.9.0.165; >= 5.10.0, < 5.10.0.312 |
| WSO2 | WSO2 Open Banking KM | >= 1.3.0, < 1.3.0.114; >= 1.4.0, < 1.4.0.130; >= 1.5.0, < 1.5.0.120 |
References
Timeline
- Published
- May 30, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Modified