CVE-2025-9955 - CVE House
Back to Database
Status published Medium CVE-2025-9955

Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration

Vulnerability Description

An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9955

Credits & Attribution

No credits recorded in the NVD database.

References

More from WSO2

View All →
CVE-2025-9973
Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
Medium 6.4
CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Critical 9.6
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Critical 9.8
CVE-2025-9152
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
Critical 9.8
CVE-2025-8591
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Medium 6.1

Affected Vendor

Affected Software

WSO2 Enterprise Integrator, WSO2 Enterprise Service Bus, org.wso2.carbon:org.wso2.carbon.base, org.wso2.carbon:org.wso2.carbon.server.admin
Vulnerable Versions:
0, 6.0.0, 6.1.0, 6.1.1, 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0, 5.0.0, 4.4.8, 4.4.14, 4.4.16, 4.4.26, 4.4.32, 4.4.36, 4.4.40, 4.5.3, 4.9, 4.10

Timeline

Official Publish: October 16th, 2025
Last Modified: October 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.