A privilege escalation vulnerability exists in multiple [Vendor Name] products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:
* SOAP admin services are accessible to the attacker.
* The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.
* At least one custom role exists with non-default permissions.
* The attacker has knowledge of the custom role and the internal attribute used in the deployment.
Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Oct 2025, 13:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_am:1.3.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_km:1.3.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* |
|
| First Time |
Wso2 identity Server
Wso2 identity Server As Key Manager Wso2 api Manager Wso2 open Banking Iam Wso2 Wso2 open Banking Km Wso2 open Banking Am |
|
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573/ - Vendor Advisory |
30 May 2025, 16:31
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-30 15:15
Updated : 2025-10-06 13:58
NVD link : CVE-2024-7096
Mitre link : CVE-2024-7096
CVE.ORG link : CVE-2024-7096
JSON object : View
Products Affected
wso2
- open_banking_iam
- identity_server
- open_banking_km
- api_manager
- open_banking_am
- identity_server_as_key_manager
CWE
CWE-863
Incorrect Authorization