Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

Description

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.

Scores

EPSS (exploitation in 30 days)

0.66% · top 48% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-863 Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• WSO2 · WSO2 Open Banking AM

  • unknown < 1.3.0
  • affected 1.3.0 – < 1.3.0.131
  • affected 1.4.0 – < 1.4.0.134
  • affected 1.5.0 – < 1.5.0.136
  • affected 2.0.0 – < 2.0.0.343

• WSO2 · WSO2 Open Banking KM

  • unknown < 1.3.0
  • affected 1.3.0 – < 1.3.0.114
  • affected 1.4.0 – < 1.4.0.130
  • affected 1.5.0 – < 1.5.0.120

• WSO2 · WSO2 Identity Server as Key Manager

  • unknown < 5.3.0
  • affected 5.3.0 – < 5.3.0.38
  • affected 5.5.0 – < 5.5.0.51
  • affected 5.6.0 – < 5.6.0.72
  • affected 5.7.0 – < 5.7.0.122
  • affected 5.9.0 – < 5.9.0.165
  • affected 5.10.0 – < 5.10.0.312

• WSO2 · WSO2 API Manager

  • unknown < 2.0.0
  • affected 2.0.0 – < 2.0.0.29
  • affected 2.1.0 – < 2.1.0.39
  • affected 2.2.0 – < 2.2.0.56
  • affected 2.5.0 – < 2.5.0.83
  • affected 2.6.0 – < 2.6.0.142
  • affected 3.0.0 – < 3.0.0.162
  • affected 3.1.0 – < 3.1.0.294
  • affected 3.2.0 – < 3.2.0.384
  • affected 3.2.1 – < 3.2.1.16
  • affected 4.0.0 – < 4.0.0.305
  • affected 4.1.0 – < 4.1.0.166
  • affected 4.2.0 – < 4.2.0.101
  • affected 4.3.0 – < 4.3.0.16

• WSO2 · WSO2 Identity Server

  • unknown < 5.2.0
  • affected 5.2.0 – < 5.2.0.32
  • affected 5.3.0 – < 5.3.0.33
  • affected 5.4.0 – < 5.4.0.32
  • affected 5.4.1 – < 5.4.1.36
  • affected 5.5.0 – < 5.5.0.50
  • affected 5.6.0 – < 5.6.0.58
  • affected 5.7.0 – < 5.7.0.123
  • affected 5.8.0 – < 5.8.0.106
  • affected 5.9.0 – < 5.9.0.157
  • affected 5.10.0 – < 5.10.0.318
  • affected 5.11.0 – < 5.11.0.365
  • affected 6.0.0 – < 6.0.0.209
  • affected 6.1.0 – < 6.1.0.188
  • affected 7.0.0 – < 7.0.0.60

• WSO2 · WSO2 Open Banking IAM

  • unknown < 2.0.0
  • affected 2.0.0 – < 2.0.0.364

• WSO2 · WSO2 Enterprise Mobility Manager

  • affected 2.2.0 – < 2.2.0.26

What to do

Solution: Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/#solution

References (1)

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3574/ (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-7097](https://trackcve.app/badge/CVE-2024-7097.svg)](https://trackcve.app/cve/CVE-2024-7097)

Record last updated 30 May 2025, 16:12 UTC.