CVE-2024-7096
mediumpriority · track · 22OT risk · elevatedEPSS 0.007 · 54 %ileEUUSEPSS · scored 2026-10-27
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (84)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-j63j-7r7r-5v4jWSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services2025-05-30ghsa · osvUS
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-7096cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-7096cnnvd
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/cnnvd
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/enisa_euvd
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan