IT SBIT Services
Schneeberger
DEEN
CVE tracker

WSO2 Identity Server: Improper authorization in SCIM endpoints

CVE-2025-10149High 8.2

← All vulnerabilities

Summary

Several WSO2 products, including Identity Server, Identity Server as Key Manager, Open Banking IAM and the Carbon SCIM components, do not properly validate authorization in the SCIM 2.0 and SCIM 1.1 endpoints when a federated user and a local user share the same username. An attacker authenticated as a federated user can perform arbitrary operations on the local account, which may lead to account takeover. The vendor rates deployments without user self-registration as medium severity.

Affected

  • WSO2 Identity Server 5.10.0 before 5.10.0.379, 5.11.0 before 5.11.0.415, 6.0.0 before 6.0.0.251, 6.1.0 before 6.1.0.251, 7.0.0 before 7.0.0.127, 7.1.0 before 7.1.0.34
  • WSO2 Identity Server as Key Manager 5.10.0 before 5.10.0.370
  • WSO2 Open Banking IAM 2.0.0 before 2.0.0.419
  • WSO2 Carbon SCIM 2.0 Common Component before 1.5.1.40 and 1.5.46.47
  • WSO2 Carbon SCIM Common Component: several version ranges, see vendor advisory
  • Other products embedding these components: unknown

Fixed in

  • Identity Server: 5.10.0.379, 5.11.0.415, 6.0.0.251, 6.1.0.251, 7.0.0.127, 7.1.0.34 or later
  • Identity Server as Key Manager: 5.10.0.370 or later
  • Open Banking IAM: 2.0.0.419 or later
  • Carbon SCIM components: fixed levels listed in the vendor advisory; community users can apply the linked fixes

Workaround

  • Prevent local and federated users from sharing the same username.
  • Disable federated user access to the SCIM endpoints.
  • These measures are reported by secondary sources and are not verified in the vendor advisory.

Exploitation

  • Not known to be exploited in the wild; not listed in CISA KEV (per secondary sources).
  • CISA SSVC exploitation: none; automatable: yes.
  • No public proof of concept found; this does not rule one out.
  • EPSS below 1 percent (per secondary sources).

Our recommendation

  • Inventory all WSO2 Identity Server, Key Manager, Open Banking IAM and Carbon SCIM components, including their versions.
  • Patch to the fixed versions listed in the vendor advisory as soon as possible.
  • If patching is delayed, disable federated access to the SCIM endpoints or enforce unique usernames across local and federated users.
  • Check whether federation or self-registration is open to external parties and look for existing username collisions.
  • Restrict access to the SCIM endpoints and monitor for unexpected changes to user accounts.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:44.

Original description (NVD)

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed