Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

🗓️ 13 Jul 2026 16:47:09Reported by GitHub Advisory DatabaseType

Summary Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId}. When configView.memberOnly.envs is enabled for the re...

Reporter	Title	Published	Views	Family All 2
CVE	CVE-2025-32781	13 Jul 202616:47	–	cve
OSV	GHSA-JXPJ-9J24-W337 Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center	13 Jul 202616:47	–	osv

Vulners

Node

com.ctrip.framework.apollo apolloRange<2.5.0maven

Source	Link
github	www.github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337
github	www.github.com/apolloconfig/apollo/pull/5378
github	www.github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
github	www.github.com/apolloconfig/apollo/releases/tag/v2.5.0
github	www.github.com/advisories/GHSA-jxpj-9j24-w337

13 Jul 2026 16:47Current

6.1Medium risk

Vulners AI Score6.1