Riskcovery

CVE-2025-8325

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

State
Published
Severity
6.3 Medium
Published
May 11, 2026
Updated
May 11, 2026
Reserved
Jul 30, 2025

Read the record on cve.org

Description

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.

A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LWSO2

Weaknesses

  • CWE-281 Assigning Permissions Instead of Checking Them

Affected Products

ProductVersions
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.18Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.17Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.17Affected
WSO2 API ManagerWSO2
  • before 3.2.0Unknown
  • 3.2.0 to before 3.2.0.435Affected
  • 3.2.1 to before 3.2.1.55Affected
  • 4.0.0 to before 4.0.0.355Affected
  • 4.1.0 to before 4.1.0.219Affected
  • 4.2.0 to before 4.2.0.157Affected
  • 4.3.0 to before 4.3.0.70Affected
  • 4.4.0 to before 4.4.0.33Affected
  • 4.5.0 to before 4.5.0.17Affected
WSO2 Carbon API Management ImplementationWSO2
  • 6.7.206 to before 6.7.206.563Affected
  • 6.7.210 to before 6.7.210.55Affected
  • 9.0.174 to before 9.0.174.513Affected
  • 9.20.74 to before 9.20.74.375Affected
  • 9.28.116 to before 9.28.116.352Affected
  • 9.29.120 to before 9.29.120.177Affected
  • 9.30.67 to before 9.30.67.100Affected
  • 9.31.86 to before 9.31.86.58Affected
  • 9.32.75 and laterNot affected
WSO2 Carbon API Manager Rest API UtilityWSO2
  • 6.7.206 to before 6.7.206.563Affected
  • 6.7.210 to before 6.7.210.55Affected
  • 9.0.174 to before 9.0.174.513Affected
  • 9.20.74 to before 9.20.74.375Affected
  • 9.28.116 to before 9.28.116.352Affected
  • 9.29.120 to before 9.29.120.177Affected
  • 9.30.67 to before 9.30.67.100Affected
  • 9.31.86 to before 9.31.86.58Affected
  • 9.32.75 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.