WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:
- SOAP admin services are accessible to the attacker.
- The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.
- At least one custom role exists with non-default permissions.
- The attacker has knowledge of the custom role and the internal attribute used in the deployment.
Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.wso2.am:am-parent | >= 2.0.0, < 4.4.0 | 4.4.0 |
| Java / Kotlin (Maven) | org.wso2.is:identity-server-parent | >= 5.2.0, < 7.1.0 | 7.1.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-7096
- https://github.com/wso2/docs-security/blob/cfd53689909eef62fc5427e193e35e7df8ab1ef8/en/docs/security-announcements/security-advisories/2024/WSO2-2024-3573.md
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573
- CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-863- Platform
- Java / Kotlin (Maven)
- Package
org.wso2.am:am-parent, org.wso2.is:identity-server-parent- Disclosed
- 30.05.2025
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j63j-7r7r-5v4j - CC BY 4.0
Vulnerability history: org.wso2.is:identity-server-parent
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 02.2025 05.2025
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2025: 2
- 2026: 0
-
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.