Incorrect Authorization in WSO2 SOAP Admin Service Account Creation

Successful exploitation allows an attacker to create unauthorized low-privileged user accounts and obtain access to the affected system as those accounts. This can expand the attack surface, enable persistent unauthorized access at a basic privilege level, and facilitate follow-on activity depending on the permissions granted to standard users in the deployment. Repeated exploitation may also cause resource exhaustion or operational degradation through mass account creation.

If immediate patching is not possible, restrict or disable access to the vulnerable SOAP admin service wherever feasible. Limit exposure of administrative SOAP endpoints to trusted management networks only, enforce network-layer access controls, and place the service behind authentication and segmentation controls. Monitor for anomalous spikes in user creation events and implement alerting for account provisioning through SOAP admin interfaces. As a compensating control, regularly review newly created accounts and disable unauthorized ones.

Apply the vendor-provided security updates or fixed versions for the affected WSO2 products that correct authorization handling in the SOAP admin service account creation workflow. Review and remove any unauthorized accounts created prior to patching, and audit authentication and administrative logs for suspicious account provisioning activity. Validate after remediation that self-registration settings are properly enforced by all exposed account creation interfaces, including SOAP-based administrative services.