CVE-2025-8325

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

• wso2 api control plane (>= 4.5.0 < 4.5.0.18) • wso2 api manager (>= 3.2.0 < 3.2.0.435) • wso2 api manager (>= 3.2.1 < 3.2.1.55) • wso2 api manager (>= 4.0.0 < 4.0.0.355) • wso2 api manager (>= 4.1.0 < 4.1.0.219) • wso2 api manager (>= 4.2.0 < 4.2.0.157) • wso2 api manager (>= 4.3.0 < 4.3.0.70) • wso2 api manager (>= 4.4.0 < 4.4.0.33) • wso2 api manager (>= 4.5.0 < 4.5.0.17) • wso2 traffic manager (>= 4.5.0 < 4.5.0.17) • wso2 universal gateway (>= 4.5.0 < 4.5.0.17)