CVE-2025-9804

mediumpriority · track · 26EPSS 0.006 · 46 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (46th) EPSS

CVSS 6.5 · medium

Is it mine?

209 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

cvss

Technical severity, 0–10. One row per scoring source.

9.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6–9.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.19.6criticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.6criticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

affected products (209)

Products and version ranges known to be affected.

WSO2 API Manager Analytics2.0.0 → 2.0.0.14enisa_euvdEU
WSO2 API Manager Analytics2.1.0 → 2.1.0.19enisa_euvdEU
WSO2 API Manager Analytics2.2.0 → 2.2.0.30enisa_euvdEU
WSO2 API Manager Analytics2.5.0 → 2.5.0.39enisa_euvdEU
WSO2 WSO2 API Control Plane4.5.0 → 4.5.0.24enisa_euvdEU
WSO2 WSO2 API Manager2.0.0 → 2.0.0.31enisa_euvdEU
WSO2 WSO2 API Manager2.1.0 → 2.1.0.40enisa_euvdEU
WSO2 WSO2 API Manager2.2.0 → 2.2.0.59enisa_euvdEU
WSO2 WSO2 API Manager2.5.0 → 2.5.0.85enisa_euvdEU
WSO2 WSO2 API Manager2.6.0 → 2.6.0.146enisa_euvdEU
WSO2 WSO2 API Manager3.0.0 → 3.0.0.176enisa_euvdEU
WSO2 WSO2 API Manager3.1.0 → 3.1.0.340enisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.441enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.61enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.361enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.224enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.162enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.75enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.39enisa_euvdEU
WSO2 WSO2 API Manager4.5.0 → 4.5.0.23enisa_euvdEU

showing 20 of 209

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2025-10-16modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan