CVE-2025-9955Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
- 5.7MediumCVSS base score
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.
Timeline
ID reserved
By WSO2
- 43 days later
· 43 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium5.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.
Affected products
WSO2 · WSO2 Enterprise Integrator
- unknown < 6.0.0
- affected 6.0.0 – < 6.0.0.22
- affected 6.1.0 – < 6.1.0.39
- affected 6.1.1 – < 6.1.1.43
- affected 6.2.0 – < 6.2.0.62
- affected 6.3.0 – < 6.3.0.70
- affected 6.4.0 – < 6.4.0.100
- affected 6.5.0 – < 6.5.0.107
- affected 6.6.0 – < 6.6.0.222
WSO2 · WSO2 Enterprise Service Bus
- unknown < 5.0.0
- affected 5.0.0 – < 5.0.0.29
WSO2 · org.wso2.carbon:org.wso2.carbon.base
- affected 4.4.8 – < 4.4.8.7
- affected 4.4.14 – < 4.4.14.5
- affected 4.4.16 – < 4.4.16.9
- affected 4.4.26 – < 4.4.26.13
- affected 4.4.32 – < 4.4.32.16
- affected 4.4.36 – < 4.4.36.7
- affected 4.4.40 – < 4.4.40.37
- affected 4.5.3 – < 4.5.3.45
- affected 4.9 – < 4.9.29
- affected 4.10 – < 4.10.94
WSO2 · org.wso2.carbon:org.wso2.carbon.server.admin
- affected 4.4.8 – < 4.4.8.7
- affected 4.4.14 – < 4.4.14.5
- affected 4.4.16 – < 4.4.16.9
- affected 4.4.26 – < 4.4.26.13
- affected 4.4.32 – < 4.4.32.16
- affected 4.4.36 – < 4.4.36.7
- affected 4.4.40 – < 4.4.40.37
- affected 4.5.3 – < 4.5.3.45
- affected 4.9 – < 4.9.29
- affected 4.10 – < 4.10.94
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4526/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4526/#solution
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-34752 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-9955)Record last updated .