The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.

A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 Identity Server as Key Manager unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.370
WSO2 WSO2 Open Banking IAM unaffected
Version Status Constraints
0 unknown < 2.0.0
2.0.0 affected < 2.0.0.419
WSO2 WSO2 Identity Server unaffected
Version Status Constraints
0 unknown < 5.10.0
5.10.0 affected < 5.10.0.379
5.11.0 affected < 5.11.0.415
6.0.0 affected < 6.0.0.251
6.1.0 affected < 6.1.0.251
7.0.0 affected < 7.0.0.127
7.1.0 affected < 7.1.0.34
WSO2 WSO2 Carbon SCIM Common Component unknown
Version Status Constraints
5.6.0 affected < 5.6.0.1
5.6.1 affected < 5.6.1.2
5.7.0 affected < 5.7.0.3
5.7.1 affected < 5.7.1.1
5.7.7 affected < 5.7.7.1
5.7.8 affected < 5.7.8.1
WSO2 WSO2 Carbon SCIM 2.0 Common Component unknown
Version Status Constraints
1.5.1 affected < 1.5.1.40
1.5.46 affected < 1.5.46.47

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Wso2 Subscribe
Wso2 Carbon Scim 2.0 Common Component Subscribe
Wso2 Carbon Scim Common Component Subscribe
Wso2 Identity Server Subscribe
Wso2 Identity Server As Key Manager Subscribe
Wso2 Open Banking Iam Subscribe
Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/ cve-icon cve-icon
History

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.
Title Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
First Time appeared Wso2
Wso2 wso2 Carbon Scim 2.0 Common Component
Wso2 wso2 Carbon Scim Common Component
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Iam
Weaknesses CWE-281
CWE-668
CPEs cpe:2.3:a:wso2:wso2_carbon_scim_2.0_common_component:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 wso2 Carbon Scim 2.0 Common Component
Wso2 wso2 Carbon Scim Common Component
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Iam
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-10-19T16:40:26.522Z

Reserved: 2025-09-09T06:03:06.474Z

Link: CVE-2025-10149

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T17:16:59.007

Modified: 2026-10-19T17:16:59.007

Link: CVE-2025-10149

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T17:30:13Z

Weaknesses