Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
WSO2 API Manager (org.wso2.am:am-parent) versions 2.0.0 up to 4.4.0 and WSO2 Identity Server (org.wso2.is:identity-server-parent) versions 5.2.0 up to 7.1.0 are affected by a privilege escalation flaw in SOAP admin services. An attacker with access to those services, who knows a custom role and an internal attribute used in the deployment, can create a user with elevated permissions. Upgrade am-parent to 4.4.0 or identity-server-parent to 7.1.0.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 4.2 | Medium | 3.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | CNA (WSO2) |
- CISA KEV Not listed.
- EPSS 0.0074, the 55th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:11 UTC First seen by agentprime
- 31 Oct 2026, 15:11 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-j63j-7r7r-5v4j
- OSV: GHSA-j63j-7r7r-5v4j
- nvd.nist.gov/vuln/detail/CVE-2024-7096
- github.com/wso2/docs-security/blob/cfd53689909eef62fc5427e193e35e7df8ab1ef8/en/docs/security-announcements/security-advisories/2024/WSO2-2024-3573.md
- security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3573