WSO2 APIM 3.x RBAC Bypass in Gateway & Internal Service APIs
CVE-2025-8325 Published on May 11, 2026

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-8325 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

LOW

Weakness Type

Improper Preservation of Permissions

The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Products Associated with CVE-2025-8325

Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.

Wso2 Api Control Plane

Wso2 Universal Gateway

Wso2 Traffic Manager

Wso2 Api Manager

Wso2 Carbon Api Management Implementation

Wso2 Carbon Api Manager Rest Api Utility

Affected Versions

WSO2 API Control Plane:

Version 4.5.0 and below 4.5.0.18 is affected.

WSO2 Universal Gateway:

Version 4.5.0 and below 4.5.0.17 is affected.

WSO2 Traffic Manager:

Version 4.5.0 and below 4.5.0.17 is affected.

WSO2 API Manager:

Before 3.2.0 is unknown.
Version 3.2.0 and below 3.2.0.435 is affected.
Version 3.2.1 and below 3.2.1.55 is affected.
Version 4.0.0 and below 4.0.0.355 is affected.
Version 4.1.0 and below 4.1.0.219 is affected.
Version 4.2.0 and below 4.2.0.157 is affected.
Version 4.3.0 and below 4.3.0.70 is affected.
Version 4.4.0 and below 4.4.0.33 is affected.
Version 4.5.0 and below 4.5.0.17 is affected.

WSO2 Carbon API Management Implementation:

Version 6.7.206 and below 6.7.206.563 is affected.
Version 6.7.210 and below 6.7.210.55 is affected.
Version 9.0.174 and below 9.0.174.513 is affected.
Version 9.20.74 and below 9.20.74.375 is affected.
Version 9.28.116 and below 9.28.116.352 is affected.
Version 9.29.120 and below 9.29.120.177 is affected.
Version 9.30.67 and below 9.30.67.100 is affected.
Version 9.31.86 and below 9.31.86.58 is affected.
Version 9.32.75, <= * is unaffected.

WSO2 Carbon API Manager Rest API Utility:

Version 6.7.206 and below 6.7.206.563 is affected.
Version 6.7.210 and below 6.7.210.55 is affected.
Version 9.0.174 and below 9.0.174.513 is affected.
Version 9.20.74 and below 9.20.74.375 is affected.
Version 9.28.116 and below 9.28.116.352 is affected.
Version 9.29.120 and below 9.29.120.177 is affected.
Version 9.30.67 and below 9.30.67.100 is affected.
Version 9.31.86 and below 9.31.86.58 is affected.
Version 9.32.75, <= * is unaffected.

Exploit Probability

EPSS

0.04%

Percentile

11.53%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.