CVE-2025-10149 Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server as Key Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.370",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking IAM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.419",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.379",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.11.0",
        "lessThan": "5.11.0.415",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.0.0.251",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.0.251",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.127",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.0",
        "lessThan": "7.1.0.34",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon SCIM Common Component",
    "packageName": "org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common",
    "versions": [
      {
        "status": "affected",
        "version": "5.6.0",
        "lessThan": "5.6.0.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.6.1",
        "lessThan": "5.6.1.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.7.0",
        "lessThan": "5.7.0.3",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.7.1",
        "lessThan": "5.7.1.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.7.7",
        "lessThan": "5.7.7.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.7.8",
        "lessThan": "5.7.8.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon SCIM 2.0 Common Component",
    "packageName": "org.wso2.carbon.identity.inbound.provisioning.scim2:org.wso2.carbon.identity.scim2.common",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.1",
        "lessThan": "1.5.1.40",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.5.46",
        "lessThan": "1.5.46.47",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]