ZeroDay Findings
Sign inSign up

Findings

CVE-2025-8325

The software fails to enforce role-based access controls for certain Gateway API invocations.

Published May 11, 2026 · updated Oct 14, 2026 · wso2 api control plane

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Timeline

Detection, updates, and resolution for this record.

  1. May 11, 2026 · NIST NVD

    Detected

    The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive

  2. Oct 14, 2026 · NIST NVD

    Updated

    The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive

Affected

  • cpe wso2/api control planeversion unspecified
  • cpe wso2/api managerversion unspecified
  • cpe wso2/traffic managerversion unspecified
  • cpe wso2/universal gatewayversion unspecified

Sources

  • CVE.orgCVE-2025-8325

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2025-8325

    The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them

    nvd.nist.gov

References