PatchTheCVECVE-2025-9804: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enfor
45
This month
CRITICAL 9.6DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2025-9804 is a critical-severity flaw (CVSS 9.6) affecting api control plane, api manager, api manager analytics. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Why this priority
- Critical severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.6 (Critical) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 54%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2025-10-16 |
| Last modified | 2026-09-26 |
Last updated 2026-09-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
wso2 api control plane DOWNGRADE
Affected: 4.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.5.0
1. Check installed version
apt-cache policy api-control-plane || rpm -q api-control-plane || api-control-plane --version
2. No fixed release: DOWNGRADE to a release before 4.5.0 (Debian / Ubuntu)
apt-cache madison api-control-plane
sudo apt install api-control-plane=<VERSION_BEFORE_4.5.0>
sudo apt-mark hold api-control-plane
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list api-control-plane
sudo dnf downgrade api-control-plane-<VERSION_BEFORE_4.5.0>
sudo dnf versionlock add api-control-plane
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
wso2 api manager DOWNGRADE
Affected: 2.0.0 · 2.1.0 · 2.2.0 · 2.5.0 · 2.6.0 · 3.0.0 · 3.1.0 · 3.2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy api-manager || rpm -q api-manager || api-manager --version
2. No fixed release: DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison api-manager
sudo apt install api-manager=<VERSION_BEFORE_2.0.0>
sudo apt-mark hold api-manager
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list api-manager
sudo dnf downgrade api-manager-<VERSION_BEFORE_2.0.0>
sudo dnf versionlock add api-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
wso2 api manager analytics DOWNGRADE
Affected: 2.0.0 · 2.1.0 · 2.2.0 · 2.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy api-manager-analytics || rpm -q api-manager-analytics || api-manager-analytics --version
2. No fixed release: DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison api-manager-analytics
sudo apt install api-manager-analytics=<VERSION_BEFORE_2.0.0>
sudo apt-mark hold api-manager-analytics
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list api-manager-analytics
sudo dnf downgrade api-manager-analytics-<VERSION_BEFORE_2.0.0>
sudo dnf versionlock add api-manager-analytics
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
wso2 data analytics server DOWNGRADE
Affected: 3.1.0 · 3.2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.1.0
1. Check installed version
apt-cache policy data-analytics-server || rpm -q data-analytics-server || data-analytics-server --version
2. No fixed release: DOWNGRADE to a release before 3.1.0 (Debian / Ubuntu)
apt-cache madison data-analytics-server
sudo apt install data-analytics-server=<VERSION_BEFORE_3.1.0>
sudo apt-mark hold data-analytics-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list data-analytics-server
sudo dnf downgrade data-analytics-server-<VERSION_BEFORE_3.1.0>
sudo dnf versionlock add data-analytics-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
wso2 enterprise integrator DOWNGRADE
Affected: 6.2.0 · 6.3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.2.0
1. Check installed version
apt-cache policy enterprise-integrator || rpm -q enterprise-integrator || enterprise-integrator --version
2. No fixed release: DOWNGRADE to a release before 6.2.0 (Debian / Ubuntu)
apt-cache madison enterprise-integrator
sudo apt install enterprise-integrator=<VERSION_BEFORE_6.2.0>
sudo apt-mark hold enterprise-integrator
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list enterprise-integrator
sudo dnf downgrade enterprise-integrator-<VERSION_BEFORE_6.2.0>
sudo dnf versionlock add enterprise-integrator
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
wso2 enterprise mobility manager DOWNGRADE
Affected: 2.2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.2.0
1. Check installed version
apt-cache policy enterprise-mobility-manager || rpm -q enterprise-mobility-manager || enterprise-mobility-manager --version
2. No fixed release: DOWNGRADE to a release before 2.2.0 (Debian / Ubuntu)
apt-cache madison enterprise-mobility-manager
sudo apt install enterprise-mobility-manager=<VERSION_BEFORE_2.2.0>
sudo apt-mark hold enterprise-mobility-manager
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list enterprise-mobility-manager
sudo dnf downgrade enterprise-mobility-manager-<VERSION_BEFORE_2.2.0>
sudo dnf versionlock add enterprise-mobility-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-9804?
api control plane: downgrade or apply the listed mitigation; api manager: downgrade or apply the listed mitigation; api manager analytics: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-9804 being exploited?
CVE-2025-9804 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-9804 affect?
CVE-2025-9804 affects api control plane, api manager, api manager analytics. Severity is critical (CVSS 9.6). An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauth
How urgent is CVE-2025-9804?
Priority 45/100. Critical severity
Related CVEs
- CVE-2024-6832 MEDIUM 5.9 DOWNGRADE DOWNGRADE The account locking mechanism fails to trigger when secondary user stores are inaccessible
- CVE-2024-10302 MEDIUM 4.0 DOWNGRADE DOWNGRADE The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input
- CVE-2024-8995 MEDIUM 4.9 UPGRADE UPGRADE Unused authorization codes issued to deleted users are not being properly invalidated or removed from the syst
- CVE-2025-12737 HIGH 8.4 UPGRADE UPGRADE The administrative operations within the Carbon Console do not adequately validate specific user-supplied inpu
- CVE-2025-9152 CRITICAL 9.8 DOWNGRADE DOWNGRADE An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and au