WSO2 API Control Plane Gateway API permissions

Summaryinfo

A vulnerability was found in WSO2 API Control Plane, Universal Gateway, Traffic Manager, API Manager, Carbon API Management Implementation and Carbon API Manager Rest API Utility. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Gateway API. This manipulation causes permissions. This vulnerability appears as CVE-2025-8325. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in WSO2 API Control Plane, Universal Gateway, Traffic Manager, API Manager, Carbon API Management Implementation and Carbon API Manager Rest API Utility. Affected by this vulnerability is an unknown function of the component Gateway API. The manipulation with an unknown input leads to a permissions vulnerability. The CWE definition for the vulnerability is CWE-281. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

The advisory is shared at security.docs.wso2.com. This vulnerability is known as CVE-2025-8325 since 07/30/2025. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-209759). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• WSO2

Name

• API Control Plane
• API Manager
• Carbon API Management Implementation
• Carbon API Manager Rest API Utility
• Traffic Manager
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion