CyberSecBulletin
CVE-2025-8325NVD status: Analyzed

WSO2 API Control Plane: Improper Preservation of Permissions

Published Updated By the CyberSecBulletin desk

CVE-2025-8325 is a high-severity improper preservation of permissions vulnerability in WSO2 API Control Plane from WSO2, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 4.5.0.18 as the first without the flaw, so updating WSO2 API Control Plane to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update WSO2 API Control Plane to 4.5.0.18 or a later version.
  2. Update WSO2 Universal Gateway to 4.5.0.17 or a later version.
  3. Update WSO2 Traffic Manager to 4.5.0.17 or a later version.
  4. Read the advisory on security.docs.wso2.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
WSO2WSO2 API Control Plane4.5.0 up to, but not including, 4.5.0.184.5.0.18
WSO2WSO2 Universal Gateway4.5.0 up to, but not including, 4.5.0.174.5.0.17
WSO2WSO2 Traffic Manager4.5.0 up to, but not including, 4.5.0.174.5.0.17
WSO2WSO2 API Manager3.2.0 up to, but not including, 3.2.0.435; 3.2.1 up to, but not including, 3.2.1.55; 4.0.0 up to, but not including, 4.0.0.355; 4.1.0 up to, but not including, 4.1.0.219; 4.2.0 up to, but not including, 4.2.0.157; 4.3.0 up to, but not including, 4.3.0.70; 4.4.0 up to, but not including, 4.4.0.33; 4.5.0 up to, but not including, 4.5.0.173.2.0.435, 3.2.1.55, 4.0.0.355, 4.1.0.219, 4.2.0.157, 4.3.0.70
WSO2WSO2 Carbon API Management Implementation6.7.206 up to, but not including, 6.7.206.563; 6.7.210 up to, but not including, 6.7.210.55; 9.0.174 up to, but not including, 9.0.174.513; 9.20.74 up to, but not including, 9.20.74.375; 9.28.116 up to, but not including, 9.28.116.352; 9.29.120 up to, but not including, 9.29.120.177; 9.30.67 up to, but not including, 9.30.67.100; 9.31.86 up to, but not including, 9.31.86.586.7.206.563, 6.7.210.55, 9.0.174.513, 9.20.74.375, 9.28.116.352, 9.29.120.177
WSO2WSO2 Carbon API Manager Rest API Utility6.7.206 up to, but not including, 6.7.206.563; 6.7.210 up to, but not including, 6.7.210.55; 9.0.174 up to, but not including, 9.0.174.513; 9.20.74 up to, but not including, 9.20.74.375; 9.28.116 up to, but not including, 9.28.116.352; 9.29.120 up to, but not including, 9.29.120.177; 9.30.67 up to, but not including, 9.30.67.100; 9.31.86 up to, but not including, 9.31.86.586.7.206.563, 6.7.210.55, 9.0.174.513, 9.20.74.375, 9.28.116.352, 9.29.120.177
WSO2API Control Plane4.5.0 up to, but not including, 4.5.0.184.5.0.18
WSO2API Manager3.2.0 up to, but not including, 3.2.0.435; 3.2.1 up to, but not including, 3.2.1.55; 4.0.0 up to, but not including, 4.0.0.355; 4.1.0 up to, but not including, 4.1.0.219; 4.2.0 up to, but not including, 4.2.0.157; 4.3.0 up to, but not including, 4.3.0.70; 4.4.0 up to, but not including, 4.4.0.33; 4.5.0 up to, but not including, 4.5.0.173.2.0.435, 3.2.1.55, 4.0.0.355, 4.1.0.219, 4.2.0.157, 4.3.0.70
WSO2Traffic Manager4.5.0 up to, but not including, 4.5.0.174.5.0.17
WSO2Universal Gateway4.5.0 up to, but not including, 4.5.0.174.5.0.17

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.3MediumCNA
CVSS 3.18.8HighNVD

Official description

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

More Improper Preservation of Permissions vulnerabilities (CWE-281)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in WSO2 API Control Plane

All WSO2 API Control Plane vulnerabilities

Recent Improper Preservation of Permissions vulnerabilities

Spotted an error? Tell us.