← Back

CVE-2025-8325

nvd nist
Published: May 11, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Affected (11)

Wso2
4 products
Api Control Plane
Api Manager
Traffic Manager
Universal Gateway
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Api Control Plane
From 4.5.0 to 4.5.0.18
Configuration B
8 vulnerable
Vulnerable SoftwareAffected Versions
Wso2
Api Manager
From 3.2.0 to 3.2.0.435
Api Manager
From 3.2.1 to 3.2.1.55
Api Manager
From 4.0.0 to 4.0.0.355
Api Manager
From 4.1.0 to 4.1.0.219
Api Manager
From 4.2.0 to 4.2.0.157
Api Manager
From 4.3.0 to 4.3.0.70
Api Manager
From 4.4.0 to 4.4.0.33
Api Manager
From 4.5.0 to 4.5.0.17
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Traffic Manager
From 4.5.0 to 4.5.0.17
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Universal Gateway
From 4.5.0 to 4.5.0.17

Related CWEs

CWE-281
Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (1)

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
Vendor Advisory

Timeline

No history available yet.