CVE-2025-8325: Improper Preservation of Permissions

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x...

CVE-2020-25688

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal t...

PT-2020-16158

Name of the Vulnerable Software and Affected Versions rhacm versions prior to 2.0.5 rhacm versions prior to 2.1.0 Description A flaw was found in the provisioning of internal service APIs, which were incorrectly set up using a test certificate from the source repository. This results in all...