CVE-2024-6914 – Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

https://notcve.org/view.php?id=CVE-2024-6914

30 Dec 2024 — An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges. This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if ... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3561 • CWE-863: Incorrect Authorization •