What’s Vulnerable › Vulnerabilities
CVE-2024-7096: Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-30 · updated 2026-06-17
- Weakness: CWE-863
Description
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Affected products
- WSO2 API Manager: 2.0.0, 2.1.0, 2.2.0, 2.5.0, 2.6.0, 3.0.0 (+7)
- WSO2 Identity Server: 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0 (+8)
- WSO2 Identity Server As Key Manager: 5.3.0, 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0
- WSO2 Open Banking Am: 1.3.0, 1.4.0, 1.5.0, 2.0.0
- WSO2 Open Banking Iam: 2.0.0
- WSO2 Open Banking Km: 1.3.0, 1.4.0, 1.5.0
References
Get alerted when CVE-2024-7096 or the next vulnerability affects your stack