cveboard RSS feed

CVE-2025-8325

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.18UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.17UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.17UnavailableNone listed

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.2.0UnavailableNone listed
3.2.0affectedcustom3.2.0.435UnavailableNone listed
3.2.1affectedcustom3.2.1.55UnavailableNone listed
4.0.0affectedcustom4.0.0.355UnavailableNone listed
4.1.0affectedcustom4.1.0.219UnavailableNone listed
4.2.0affectedcustom4.2.0.157UnavailableNone listed
4.3.0affectedcustom4.3.0.70UnavailableNone listed
4.4.0affectedcustom4.4.0.33UnavailableNone listed
4.5.0affectedcustom4.5.0.17UnavailableNone listed

WSO2 Carbon API Management Implementation

Vendor
WSO2
Product
WSO2 Carbon API Management Implementation
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl
WSO2 Carbon API Management Implementation · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.7.206affectedcustom6.7.206.563UnavailableNone listed
6.7.210affectedcustom6.7.210.55UnavailableNone listed
9.0.174affectedcustom9.0.174.513UnavailableNone listed
9.20.74affectedcustom9.20.74.375UnavailableNone listed
9.28.116affectedcustom9.28.116.352UnavailableNone listed
9.29.120affectedcustom9.29.120.177UnavailableNone listed
9.30.67affectedcustom9.30.67.100UnavailableNone listed
9.31.86affectedcustom9.31.86.58UnavailableNone listed
9.32.75unaffectedcustomUnavailable*None listed

WSO2 Carbon API Manager Rest API Utility

Vendor
WSO2
Product
WSO2 Carbon API Manager Rest API Utility
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util
WSO2 Carbon API Manager Rest API Utility · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.7.206affectedcustom6.7.206.563UnavailableNone listed
6.7.210affectedcustom6.7.210.55UnavailableNone listed
9.0.174affectedcustom9.0.174.513UnavailableNone listed
9.20.74affectedcustom9.20.74.375UnavailableNone listed
9.28.116affectedcustom9.28.116.352UnavailableNone listed
9.29.120affectedcustom9.29.120.177UnavailableNone listed
9.30.67affectedcustom9.30.67.100UnavailableNone listed
9.31.86affectedcustom9.31.86.58UnavailableNone listed
9.32.75unaffectedcustomUnavailable*None listed