CVE-2025-8325
Description
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
How to fix
- wso2 api_control_plane4.5.0.18 or later
- wso2 api_manager3.2.0.435, 3.2.1.55, 4.0.0.355, 4.1.0.219, 4.2.0.157, 4.3.0.70, 4.4.0.33, 4.5.0.17 or later
- wso2 traffic_manager4.5.0.17 or later
- wso2 universal_gateway4.5.0.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_control_plane | 4.5.0 ≤ v < 4.5.0.18 | 4.5.0.18 |
| wso2 api_manager | 3.2.0 ≤ v < 3.2.0.435, 3.2.1 ≤ v < 3.2.1.55, 4.0.0 ≤ v < 4.0.0.355, 4.1.0 ≤ v < 4.1.0.219, 4.2.0 ≤ v < 4.2.0.157, 4.3.0 ≤ v < 4.3.0.70, 4.4.0 ≤ v < 4.4.0.33, 4.5.0 ≤ v < 4.5.0.17 | 3.2.0.435, 3.2.1.55, 4.0.0.355, 4.1.0.219, 4.2.0.157, 4.3.0.70, 4.4.0.33, 4.5.0.17 |
| wso2 traffic_manager | 4.5.0 ≤ v < 4.5.0.17 | 4.5.0.17 |
| wso2 universal_gateway | 4.5.0 ≤ v < 4.5.0.17 | 4.5.0.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.