---
id: CVE-2025-8325
title: >-
  The software fails to enforce role-based access controls for certain Gateway
  API invocations
summary: >-
  The software fails to enforce role-based access controls for certain Gateway
  API invocations. Users with the 'Internal/Everyone' role can invoke these
  APIs, bypassing intended permission checks. This same vulnerability also
  affects Inter…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-281
vendor: wso2
product: api_control_plane
affected:
  - 'api_control_plane >= 4.5.0, < 4.5.0.18'
  - 'api_manager >= 3.2.0, < 3.2.0.435'
  - 'api_manager >= 3.2.1, < 3.2.1.55'
  - 'api_manager >= 4.0.0, < 4.0.0.355'
  - 'api_manager >= 4.1.0, < 4.1.0.219'
  - 'api_manager >= 4.2.0, < 4.2.0.157'
  - 'api_manager >= 4.3.0, < 4.3.0.70'
  - 'api_manager >= 4.4.0, < 4.4.0.33'
  - 'api_manager >= 4.5.0, < 4.5.0.17'
  - 'traffic_manager >= 4.5.0, < 4.5.0.17'
  - 'universal_gateway >= 4.5.0, < 4.5.0.17'
patched:
  - api_control_plane 4.5.0.18
  - api_manager 4.5.0.17
  - traffic_manager 4.5.0.17
  - universal_gateway 4.5.0.17
published: '2026-05-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8325'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4401/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
tags:
  - nvd
epss: 0.00174
epssPercentile: 0.06327
ingestedAt: '2026-10-14T13:30:58.493Z'
---

## Overview

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.

A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

## Affected

- `api_control_plane >= 4.5.0, < 4.5.0.18`
- `api_manager >= 3.2.0, < 3.2.0.435`
- `api_manager >= 3.2.1, < 3.2.1.55`
- `api_manager >= 4.0.0, < 4.0.0.355`
- `api_manager >= 4.1.0, < 4.1.0.219`
- `api_manager >= 4.2.0, < 4.2.0.157`
- `api_manager >= 4.3.0, < 4.3.0.70`
- `api_manager >= 4.4.0, < 4.4.0.33`
- `api_manager >= 4.5.0, < 4.5.0.17`
- `traffic_manager >= 4.5.0, < 4.5.0.17`
- `universal_gateway >= 4.5.0, < 4.5.0.17`

## Remediation

Upgrade past the affected range:

- `api_control_plane 4.5.0.18`
- `api_manager 4.5.0.17`
- `traffic_manager 4.5.0.17`
- `universal_gateway 4.5.0.17`