The vulnerability stems from the SCIM endpoint’s insufficient authorization checks for federated users. When a local and a federated user share the same username, the system fails to distinguish the source of the request, allowing the federated user to execute actions intended for the local account. These arbitrary operations can include reading, updating, or deleting account data, effectively enabling a user account takeover. The weakness is classified under authentication failure and inconsistent authorization.

All WSO2 products that expose SCIM 2.0 or SCIM 1.1 endpoints are impacted. This includes WSO2 Carbon SCIM 2.0 Common Component, WSO2 Carbon SCIM Common Component, WSO2 Identity Server, WSO2 Identity Server as Key Manager, and WSO2 Open Banking IAM. No specific build or version numbers are listed, so every current installation is potentially vulnerable unless the product is configured to disallow overlapping usernames or federated SCIM usage.

The CVSS score of 8.2 marks the issue as high severity, with the EPSS score unavailable. The vulnerability can be exploited remotely by an authenticated federated user who shares a username with a local account. As the attack vector is over the network and only requires valid federated credentials, the threat to organizations that use SCIM for identity management is significant. While not yet listed in the CISA KEV catalog, the nature of the flaw suggests that an active exploit could be developed, and therefore the risk should be treated as high pending a patch.