What’s Vulnerable › Vulnerabilities
CVE-2025-12317: Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
- Severity: medium (CVSS 5.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-09-29
- Weakness: CWE-613
Description
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
Affected products
- WSO2 Enterprise Integrator: from 6.6.0 before 6.6.0.228 — fixed in 6.6.0.228
- WSO2 Identity Server: from 5.11.0 before 5.11.0.423 — fixed in 5.11.0.423
How to fix
Upgrade to a fixed version: WSO2 Enterprise Integrator 6.6.0.228; WSO2 Identity Server 5.11.0.423. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-12317 or the next vulnerability affects your stack