CVE-2025-12317

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4672/

Configurations

No configuration.

History

29 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Cuando se eliminan roles internos de un usuario dentro del producto WSO2, el sistema no invalida ningún token de autenticación emitido previamente asociado con ese usuario. Esta vulnerabilidad podría permitir a los usuarios retener sus privilegios de acceso anteriores incluso después de que sus roles hayan sido revocados. Como resultado, un usuario puede continuar realizando acciones no autorizadas o acceder a recursos restringidos hasta que los tokens caducados expiren naturalmente.

Information

Published : 2026-08-06 22:16

Updated : 2026-09-29 11:10

NVD link : CVE-2025-12317

Mitre link : CVE-2025-12317

CVE.ORG link : CVE-2025-12317

JSON object : View

Products Affected

No product.

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-12317", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12317", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:49:02.691840Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Enterprise Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.228", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.423", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-06T22:16:41.280", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4672/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.\n\nThis vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire."}, {"lang": "es", "value": "Cuando se eliminan roles internos de un usuario dentro del producto WSO2, el sistema no invalida ning\u00fan token de autenticaci\u00f3n emitido previamente asociado con ese usuario.\n\nEsta vulnerabilidad podr\u00eda permitir a los usuarios retener sus privilegios de acceso anteriores incluso despu\u00e9s de que sus roles hayan sido revocados. Como resultado, un usuario puede continuar realizando acciones no autorizadas o acceder a recursos restringidos hasta que los tokens caducados expiren naturalmente."}], "lastModified": "2026-09-29T11:10:00.150", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}