CVE-2025-8325— Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
Affected Version Matrix 30
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0< 4.5.0.18 | affected |
| WSO2 | WSO2 API Manager | < 3.2.0 | unknown |
3.2.0< 3.2.0.435 | affected | ||
3.2.1< 3.2.1.55 | affected | ||
4.0.0< 4.0.0.355 | affected | ||
4.1.0< 4.1.0.219 | affected | ||
4.2.0< 4.2.0.157 | affected | ||
4.3.0< 4.3.0.70 | affected | ||
4.4.0< 4.4.0.33 | affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Carbon API Management Implementation | 6.7.206< 6.7.206.563 | affected |
6.7.210< 6.7.210.55 | affected | ||
9.0.174< 9.0.174.513 | affected | ||
9.20.74< 9.20.74.375 | affected | ||
9.28.116< 9.28.116.352 | affected | ||
9.29.120< 9.29.120.177 | affected | ||
9.30.67< 9.30.67.100 | affected | ||
9.31.86< 9.31.86.58 | affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Carbon API Manager Rest API Utility | 6.7.206< 6.7.206.563 | affected |
6.7.210< 6.7.210.55 | affected | ||
9.0.174< 9.0.174.513 | affected | ||
9.20.74< 9.20.74.375 | affected | ||
9.28.116< 9.28.116.352 | affected | ||
9.29.120< 9.29.120.177 | affected | ||
9.30.67< 9.30.67.100 | affected | ||
9.31.86< 9.31.86.58 | affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Traffic Manager | 4.5.0< 4.5.0.17 | affected |
| WSO2 | WSO2 Universal Gateway | 4.5.0< 4.5.0.17 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-8325
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
Source: NVD (National Vulnerability Database)
Vulnerability Description
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
权限预留不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
WSO2多款产品 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WSO2 API Manager等都是美国WSO2公司的产品。WSO2 API Manager是一套API生命周期管理解决方案。WSO2 API Control Plane是一个控制面板。WSO2 Traffic Manager是一个调节和管理API流量的组件。 WSO2多款产品存在安全漏洞，该漏洞源于未能对某些Gateway API调用强制执行基于角色的访问控制，导致具有Internal/Everyone角色的用户可绕过权限检查调用这些API，同时影响Internal Service API，可能导致恶
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 ~ 4.5.0.18 | - | |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ~ 4.5.0.17 | - | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ~ 4.5.0.17 | - | |
| WSO2 | WSO2 API Manager | 3.2.0 ~ 3.2.0.435 | - | |
| WSO2 | WSO2 Carbon API Management Implementation | 6.7.206 ~ 6.7.206.563 | - | |
| WSO2 | WSO2 Carbon API Manager Rest API Utility | 6.7.206 ~ 6.7.206.563 | - |
II. Public POCs for CVE-2025-8325
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8325
请登录查看更多情报信息。
Same Patch Batch · WSO2 · 2026-05-11 · 6 CVEs total
| CVE-2025-10470 | 8.6 HIGH | Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Una |
| CVE-2025-9973 | 6.4 MEDIUM | Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Orga |
| CVE-2024-0391 | 5.3 MEDIUM | Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Disc |
| CVE-2025-8154 | 5.3 MEDIUM | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Man |
| CVE-2025-10908 | Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allo |
IV. Related Vulnerabilities
Same vendor: WSO2
- CVE-2025-10470
Denial-of-Service via Magic Link Authentication in WSO2 Iden - CVE-2025-9973
Authorization Bypass via Adaptive Authentication in WSO2 Ide - CVE-2025-8154
HTTP Header Injection via Webhook API in Multiple WSO2 Produ - CVE-2025-10908
Account Lock Bypass via Magic Link or Pass Key Authenticatio - CVE-2024-0391
Username Enumeration via Email OTP Flow in Multiple WSO2 Pro
Same weakness: CWE-281
- CVE-2026-35361
uutils coreutils mknod Security Label Inconsistency and Brok - CVE-2026-35351
uutils coreutils mv Silent Ownership Loss in Cross-Device Op - CVE-2026-35350
uutils coreutils cp Unexpected Privileged Executable Creatio - CVE-2026-35385
OpenSSH 安全漏洞 - CVE-2025-9615
Networkmanager: networkmanager file access
V. Comments for CVE-2025-8325
No comments yet