CVE-2025-12317 — MEDIUM (5.0)

Vulnerability Description

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Related Weaknesses (CWE)

CWE-613

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisor

FAQ

What is CVE-2025-12317?

CVE-2025-12317 is a vulnerability with a CVSS score of 5.0 (MEDIUM). When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could all...

How severe is CVE-2025-12317?

CVE-2025-12317 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-12317?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.