CVE-2025-8325: wso2 api_control_plane Improper Preservation of Permissions
Vulnerability summary
CVE-2025-8325 is a high (CVSS 8.8) Improper Preservation of Permissions vulnerability in wso2 api_control_plane. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.
Timeline
- 11-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso210 products
- api_control_plane≥ 4.5.0, < 4.5.0.18
- api_manager≥ 3.2.0, < 3.2.0.435 | ≥ 3.2.1, < 3.2.1.55 | ≥ 4.0.0, < 4.0.0.355 | ≥ 4.1.0, < 4.1.0.219 | ≥ 4.2.0, < 4.2.0.157 | ≥ 4.3.0, < 4.3.0.70 | ≥ 4.4.0, < 4.4.0.33 | ≥ 4.5.0, < 4.5.0.17
- traffic_manager≥ 4.5.0, < 4.5.0.17
- universal_gateway≥ 4.5.0, < 4.5.0.17
- wso2 api control plane≥ 4.5.0, < 4.5.0.18
1 vendor · 10 products