Incorrect Authorization

Summary

A Privilege Escalation vulnerability exists in multiple WSO2 products which includes API manager versions 2.0.0 through 4.3.0, and identity server versions 5.2.0 through 7.0.0 due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: First, SOAP admin services are accessible to the attacker. Second, the deployment includes an internally used attribute that is not part of the default WSO2 product configuration. Third, at least one custom role exists with non-default permissions. Finally, the attacker has knowledge of the custom role and the internal attribute used in the deployment. Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.