CVE-2025-12317
Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
| CWE | CWE-613 |
| Vendor | wso2 |
| Product | wso2 enterprise integrator |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 enterprise integrator
Be the first to know when new medium vulnerabilities affecting wso2 wso2 enterprise integrator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
WSO2 / WSO2 Enterprise Integrator
6.6.0 < 6.6.0.228
WSO2 / WSO2 Identity Server
5.11.0 < 5.11.0.423