An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Wso2
  • Enterprise Integrator
  • Enterprise Service Bus

Configuration 1 [-]

OR cpe:2.3:a:wso2:enterprise_integrator:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.1.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4526/ cve-icon cve-icon
History

Tue, 21 Oct 2025 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wso2:enterprise_integrator:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.1.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*

Mon, 20 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Wso2
Wso2 enterprise Integrator
Wso2 enterprise Service Bus
Vendors & Products Wso2
Wso2 enterprise Integrator
Wso2 enterprise Service Bus

Thu, 16 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Oct 2025 12:30:00 +0000

Type Values Removed Values Added
Description An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.
Title Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2025-10-16T13:29:14.882Z

Reserved: 2025-09-03T15:10:08.622Z

Link: CVE-2025-9955

cve-icon Vulnrichment

Updated: 2025-10-16T13:23:30.628Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-16T13:15:42.300

Modified: 2025-10-21T18:32:41.200

Link: CVE-2025-9955

cve-icon Redhat

No data.