---
id: CVE-2025-32781
title: >-
  Apollo is a reliable configuration management system suitable for microservice
  configuration management scenarios
summary: >-
  Apollo is a reliable configuration management system suitable for microservice
  configuration management scenarios. Prior to 2.5.0, Apollo Portal does not
  verify application and namespace permissions when an authenticated user
  requests a …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
  - CWE-862
vendor: ctrip
product: 'com.ctrip.framework.apollo:apollo'
affected:
  - 'com.ctrip.framework.apollo:apollo < 2.5.0'
published: '2026-07-15'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T15:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32781'
references:
  - url: >-
      https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
    label: security-advisories@github.com
  - url: 'https://github.com/apolloconfig/apollo/pull/5378'
    label: security-advisories@github.com
  - url: 'https://github.com/apolloconfig/apollo/releases/tag/v2.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-jxpj-9j24-w337'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00415
epssPercentile: 0.3562
aliases:
  - GHSA-jxpj-9j24-w337
ecosystem: maven
ingestedAt: '2026-07-13T17:27:59.089Z'
---

## Overview

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-32781)

Affected packages:

- `com.ctrip.framework.apollo:apollo < 2.5.0`

Source: https://github.com/advisories/GHSA-jxpj-9j24-w337