CVE-2025-8325

highpriority · track · 35EPSS 0.002 · 7 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.17% (7th) EPSS

CVSS 8.8 · high

Is it mine?

38 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondaryexploitability 2.8 · impact 3.4

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-281US

affected products (38)

Products and version ranges known to be affected.

WSO2 WSO2 API Control Plane4.5.0 → 4.5.0.18enisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.435enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.55enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.355enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.219enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.157enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.70enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.33enisa_euvdEU
WSO2 WSO2 API Manager4.5.0 → 4.5.0.17enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation6.7.206 → 6.7.206.563enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation6.7.210 → 6.7.210.55enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.0.174 → 9.0.174.513enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.20.74 → 9.20.74.375enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.28.116 → 9.28.116.352enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.29.120 → 9.29.120.177enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.30.67 → 9.30.67.100enisa_euvdEU
WSO2 WSO2 Carbon API Management Implementation9.31.86 → 9.31.86.58enisa_euvdEU
WSO2 WSO2 Carbon API Manager Rest API Utility6.7.206 → 6.7.206.563enisa_euvdEU
WSO2 WSO2 Carbon API Manager Rest API Utility6.7.210 → 6.7.210.55enisa_euvdEU
WSO2 WSO2 Carbon API Manager Rest API Utility9.0.174 → 9.0.174.513enisa_euvdEU

showing 20 of 38

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2026-05-11modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan