CVE-2025-8325

published 2026-05-11

CVE-2025-8325: The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs…

Priority P3 56 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.

A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Affected

38 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.18	4.5.0.18
wso2	api_manager	>= 3.2.0 < 3.2.0.435	3.2.0.435
wso2	api_manager	>= 3.2.1 < 3.2.1.55	3.2.1.55
wso2	api_manager	>= 4.0.0 < 4.0.0.355	4.0.0.355
wso2	api_manager	>= 4.1.0 < 4.1.0.219	4.1.0.219
wso2	api_manager	>= 4.2.0 < 4.2.0.157	4.2.0.157
wso2	api_manager	>= 4.3.0 < 4.3.0.70	4.3.0.70
wso2	api_manager	>= 4.4.0 < 4.4.0.33	4.4.0.33
wso2	api_manager	>= 4.5.0 < 4.5.0.17	4.5.0.17
wso2	traffic_manager	>= 4.5.0 < 4.5.0.17	4.5.0.17
wso2	universal_gateway	>= 4.5.0 < 4.5.0.17	4.5.0.17
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.18	4.5.0.18
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.435	3.2.0.435
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.55	3.2.1.55
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.355	4.0.0.355
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.219	4.1.0.219
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.157	4.2.0.157
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.70	4.3.0.70
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.33	4.4.0.33
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.17	4.5.0.17
wso2	wso2_carbon_api_management_implementation	>= 6.7.206 < 6.7.206.563	6.7.206.563
wso2	wso2_carbon_api_management_implementation	>= 6.7.210 < 6.7.210.55	6.7.210.55
wso2	wso2_carbon_api_management_implementation	>= 9.0.174 < 9.0.174.513	9.0.174.513
wso2	wso2_carbon_api_management_implementation	>= 9.20.74 < 9.20.74.375	9.20.74.375
wso2	wso2_carbon_api_management_implementation	>= 9.28.116 < 9.28.116.352	9.28.116.352

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-281