CVE-2025-12317: Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.
This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow the solution instructions for advisory WSO2-2025-4672 to mitigate retained access due to improper token revocation in WSO2 SOAP services (apply the steps described in the provided WSO2 security advisory solution section).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12317?
The severity of CVE-2025-12317 is classified as medium with a score of 5.
What is CVE-2025-12317 about?
CVE-2025-12317 involves improper token revocation via SOAP services that allows retained access privileges for users in multiple WSO2 products.
How do I fix CVE-2025-12317?
To fix CVE-2025-12317, ensure that authentication tokens are invalidated when internal roles are removed for users.
What impact does CVE-2025-12317 have on WSO2 products?
CVE-2025-12317 can result in unauthorized access as users may retain access privileges despite role revocation.
Which products are affected by CVE-2025-12317?
CVE-2025-12317 affects multiple products within the WSO2 suite.