CVE-2025-8325

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x...

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.service.catalog.feature (>=8.2.11, <=9.33.97) potentially affected by CVE-2025-8325 via org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util (>=8.2.11, <=9.33.97)

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util MAVEN version =8.2.11, =8.2.11, =9.33.97 Source cves: CVE-2025-8325 Source advisory: MEND:CVE-2025-8325...