An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization.

Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00391.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Wso2
  • Api Manager
  • Enterprise Mobility Manager
  • Identity Server
  • Identity Server As Key Manager
  • Open Banking Am
  • Open Banking Iam
  • Open Banking Km

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Wso2
  • Api Manager
  • Enterprise Mobility Manager
  • Identity Server
  • Identity Server As Key Manager
  • Open Banking Am
  • Open Banking Iam
  • Open Banking Km
References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/ cve-icon cve-icon
History

Fri, 30 May 2025 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 May 2025 15:15:00 +0000

Type Values Removed Values Added
Description An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
Title Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2025-05-30T16:12:44.804Z

Reserved: 2024-07-25T07:26:31.718Z

Link: CVE-2024-7097

cve-icon Vulnrichment

Updated: 2025-05-30T16:11:13.884Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-05-30T15:15:40.227

Modified: 2025-05-30T17:15:28.103

Link: CVE-2024-7097

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-13T11:14:11Z