CVE-2025-32781: Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center
(updated )
Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId}.
When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can supply a valid release ID belonging to an application or namespace they are not authorized to view. The endpoint returns the release data without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...).
References
- github.com/advisories/GHSA-jxpj-9j24-w337
- github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
- github.com/apolloconfig/apollo/pull/5378
- github.com/apolloconfig/apollo/releases/tag/v2.5.0
- github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337
- nvd.nist.gov/vuln/detail/CVE-2025-32781
Code Behaviors & Features
Detect and mitigate CVE-2025-32781 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →