WSO2 API Manager CVE-2025-9804

Exploitation requires a valid authenticated low-privileged WSO2 account (PR:L) and network access to the affected internal administrative interfaces - specifically certain internal SOAP Admin Services and System REST APIs of WSO2 API Manager (2.0.0-3.2.1) and API Control Plane 4.5.0. Exploitation is explicitly LIMITED to these internal management interfaces: APIs exposed via the WSO2 API Manager Gateway are not affected, so deployments that expose only the Gateway externally and restrict management ports to trusted networks substantially reduce reachability. No end-user interaction is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring an authenticated low-privileged account (PR:L) with confidentiality-only impact (C:H, I:N, A:N). No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - this is not a high-CVSS-but-trivial issue, but the PR:L authentication gate and confidentiality-only impact keep it from being a top-tier emergency. The realistic risk is a privilege-boundary bypass: any authenticated tenant/low-role user can invoke internal SOAP Admin Services and System REST APIs they should not reach, exposing server-level information. The description explicitly narrows scope - only internal administrative interfaces are affected, and APIs published through the WSO2 API Manager Gateway are NOT impacted - which meaningfully limits the exposed surface for deployments where only the Gateway is externally reachable. Priority is MEDIUM: real for multi-tenant or shared WSO2 deployments where low-privilege accounts are widely provisioned, lower for hardened installs where admin/internal ports are network-restricted. No CISA SSVC automatable/technical-impact data was supplied to further refine urgency.

A low-privileged but authenticated WSO2 user (e.g., a tenant or limited-role account) directly calls an internal SOAP Admin Service or System REST API endpoint that lacks proper permission enforcement, retrieving server-level configuration or information they should not be authorized to see. No public exploit code was identified in the provided data, and the attack requires valid low-privilege credentials plus network reach to the internal management interfaces.