Key points
- CVE-2025-10149 carries a CVSS score of 8.2, rated as high severity.
- The issue affects WSO2 Identity Server, Open Banking IAM, and Carbon SCIM components.
- Exploitation requires a federated user to share a username with a local user account.
WSO2 products contain a high-severity authorization flaw that allows federated users to perform arbitrary operations on local user accounts. The vulnerability exists in SCIM endpoints when local and federated users share the same username.
The National Vulnerability Database records this issue as CVE-2025-10149 with a CVSS score of 8.2. Attackers authenticated as federated users can bypass authorization checks to execute actions intended for local users. This could lead to full user account takeover in affected environments.
Context and Background
The flaw stems from insufficient validation of authorization for federated users operating against the local user store. Weaknesses CWE-281 and CWE-668 are associated with this defect. As SecOps Monitor reported on 2026-10-15 regarding Cronicle, identity management systems frequently face complex authorization challenges that require rigorous patching.
Who Is Affected
WSO2 Identity Server versions before 5.10.0.379, 5.11.0.415, and 6.0.0.251 are vulnerable. WSO2 Identity Server as Key Manager versions before 5.10.0.370 are also affected. WSO2 Open Banking IAM versions before 2.0.0.419 face the same risk.
WSO2 Carbon SCIM Common Component versions before 5.6.0.1, 5.6.1.2, 5.7.0.3, and 5.7.1.1 are exposed. WSO2 Carbon SCIM 2.0 Common Component versions before 1.5.1.40 and 1.5.46.47 are also impacted by this authorization bypass.
Next steps
Deployments that do not support user self-registration are considered medium severity according to the record. Teams should verify if local and federated users share usernames. Organizations must check their WSO2 product versions against the affected lists provided by the vendor immediately.
Signals worth monitoring
Security teams usually monitor SCIM endpoint logs for unusual activity from federated identities. Check whether federated users are performing operations on local accounts that do not match their typical behavior. Look for unexpected privilege escalations or configuration changes initiated by federated users. Verify if any local user accounts have been modified by identities originating from external identity providers. Investigate any alerts indicating authorization bypass attempts on user management APIs.
What to do and how to stay safe: WSO2
- Audit your WSO2 Identity Server and IAM versions to confirm if they fall within the affected ranges listed in the advisory.
- Review SCIM endpoint logs for any instances where federated users have interacted with local user store operations.
- Ensure that federated users and local users do not share identical usernames to mitigate the risk of this specific bypass.
- Monitor for unauthorized account modifications or privilege changes that could indicate an ongoing exploitation attempt.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WSO2 products are affected by CVE-2025-10149?
WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking IAM, WSO2 Carbon SCIM Common Component, and WSO2 Carbon SCIM 2.0 Common Component are affected.
What is the severity rating for this vulnerability?
The National Vulnerability Database rates CVE-2025-10149 as high severity with a CVSS score of 8.2.
Does this flaw allow remote code execution?
The source material states it allows arbitrary operations on local user accounts, which could lead to user account takeover, but does not explicitly confirm remote code execution.
