What’s Vulnerable › Vulnerabilities
CVE-2024-7097: Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-05-30 · updated 2026-06-17
- Weakness: CWE-863
Description
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Affected products
- WSO2 API Manager: 2.1.0, 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0 (+6)
- WSO2 Identity Server: 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0 (+8)
- WSO2 Identity Server As Key Manager: 5.3.0, 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0
- WSO2 Open Banking Am: 2.0.0
- WSO2 Open Banking Iam: 2.0.0
- WSO2 Open Banking Km: 1.3.0, 1.4.0, 1.5.0
References
Get alerted when CVE-2024-7097 or the next vulnerability affects your stack