CVE-2025-9804

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager’s API Gateway remain unaffected.

More information : https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/