{"id":"CVE-2025-8325","title":"The software fails to enforce role-based access controls for certain Gateway API invocations","summary":"The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Inter…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-281"],"vendor":"wso2","product":"api_control_plane","affected":["api_control_plane >= 4.5.0, < 4.5.0.18","api_manager >= 3.2.0, < 3.2.0.435","api_manager >= 3.2.1, < 3.2.1.55","api_manager >= 4.0.0, < 4.0.0.355","api_manager >= 4.1.0, < 4.1.0.219","api_manager >= 4.2.0, < 4.2.0.157","api_manager >= 4.3.0, < 4.3.0.70","api_manager >= 4.4.0, < 4.4.0.33","api_manager >= 4.5.0, < 4.5.0.17","traffic_manager >= 4.5.0, < 4.5.0.17","universal_gateway >= 4.5.0, < 4.5.0.17"],"patched":["api_control_plane 4.5.0.18","api_manager 4.5.0.17","traffic_manager 4.5.0.17","universal_gateway 4.5.0.17"],"published":"2026-05-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-8325","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4401/","label":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"tags":["nvd"],"epss":0.00174,"epssPercentile":0.06327,"ingestedAt":"2026-10-14T13:30:58.493Z","slug":"CVE-2025-8325","body":"## Overview\n\nThe software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.\n\nA malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.\n\n## Affected\n\n- `api_control_plane >= 4.5.0, < 4.5.0.18`\n- `api_manager >= 3.2.0, < 3.2.0.435`\n- `api_manager >= 3.2.1, < 3.2.1.55`\n- `api_manager >= 4.0.0, < 4.0.0.355`\n- `api_manager >= 4.1.0, < 4.1.0.219`\n- `api_manager >= 4.2.0, < 4.2.0.157`\n- `api_manager >= 4.3.0, < 4.3.0.70`\n- `api_manager >= 4.4.0, < 4.4.0.33`\n- `api_manager >= 4.5.0, < 4.5.0.17`\n- `traffic_manager >= 4.5.0, < 4.5.0.17`\n- `universal_gateway >= 4.5.0, < 4.5.0.17`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `api_control_plane 4.5.0.18`\n- `api_manager 4.5.0.17`\n- `traffic_manager 4.5.0.17`\n- `universal_gateway 4.5.0.17`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}