CVE-2025-32781Medium· 6.5▾ SunlitApollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
com.ctrip.framework.apollo:apollo < 2.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59955High· 7.5Apollo ConfigService access key authentication bypass via raw config file appId parsing
CVE-2026-59954High· 7.5Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
CVE-2026-102298High· 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check
CVE-2025-8887Medium· 6.1Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc
CVE-2025-12288Medium· 4.3A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4
CVE-2025-12283Medium· 4.3A security flaw has been discovered in code-projects Client Details System 1.0