CyberSecBulletin
CVE-2025-10149NVD status: Awaiting Analysis

WSO2 Identity Server as Key Manager: Improper Preservation of Permissions

Published Updated By the CyberSecBulletin desk

CVE-2025-10149 is a high-severity improper preservation of permissions vulnerability in WSO2 Identity Server as Key Manager from WSO2, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 5.10.0.370 as the first without the flaw, so updating WSO2 Identity Server as Key Manager to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update WSO2 Identity Server as Key Manager to 5.10.0.370 or a later version.
  2. Update WSO2 Open Banking IAM to 2.0.0.419 or a later version.
  3. Update WSO2 Identity Server to 5.10.0.379 or 5.11.0.415 or 6.0.0.251 or 6.1.0.251, whichever matches your release line, or a later version.
  4. Read the advisory on security.docs.wso2.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
WSO2WSO2 Identity Server as Key Manager5.10.0 up to, but not including, 5.10.0.3705.10.0.370
WSO2WSO2 Open Banking IAM2.0.0 up to, but not including, 2.0.0.4192.0.0.419
WSO2WSO2 Identity Server5.10.0 up to, but not including, 5.10.0.379; 5.11.0 up to, but not including, 5.11.0.415; 6.0.0 up to, but not including, 6.0.0.251; 6.1.0 up to, but not including, 6.1.0.251; 7.0.0 up to, but not including, 7.0.0.127; 7.1.0 up to, but not including, 7.1.0.345.10.0.379, 5.11.0.415, 6.0.0.251, 6.1.0.251, 7.0.0.127, 7.1.0.34
WSO2WSO2 Carbon SCIM Common Component5.6.0 up to, but not including, 5.6.0.1; 5.6.1 up to, but not including, 5.6.1.2; 5.7.0 up to, but not including, 5.7.0.3; 5.7.1 up to, but not including, 5.7.1.1; 5.7.7 up to, but not including, 5.7.7.1; 5.7.8 up to, but not including, 5.7.8.15.6.0.1, 5.6.1.2, 5.7.0.3, 5.7.1.1, 5.7.7.1, 5.7.8.1
WSO2WSO2 Carbon SCIM 2.0 Common Component1.5.1 up to, but not including, 1.5.1.40; 1.5.46 up to, but not including, 1.5.46.471.5.1.40, 1.5.46.47

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
LowSome restricted data can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. Scored by CNA.

Official description

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

More Improper Preservation of Permissions vulnerabilities (CWE-281)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in WSO2 Identity Server as Key Manager

All WSO2 Identity Server as Key Manager vulnerabilities

Recent Improper Preservation of Permissions vulnerabilities

Spotted an error? Tell us.