CVE-2025-10149: CWE-281: Improper Security Management in WSO2 WSO2 Identity Server as Key Manager

The vulnerability arises because the SCIM endpoint in WSO2 Identity Server as Key Manager does not properly validate authorization for federated users performing operations on the local user store. When a local user and a federated user share the same username, a federated user can execute arbitrary actions intended for the local user, including potentially taking over the local user account. This issue affects various versions of the product before certain patch levels, as specified in the affectedVersions list. The CVSS 3.1 score is 8.2 (high severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

A malicious actor authenticated as a federated user can perform unauthorized operations on local user accounts if usernames overlap, leading to potential user account takeover. This compromises the integrity of local user accounts. Deployments that do not support user self-registration reduce the severity to medium, indicating the risk depends on deployment configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch links are provided in the input data. Until a patch is available, administrators should review user provisioning and username policies to avoid username collisions between federated and local users. Monitoring and restricting federated user privileges may also help mitigate risk.