CVE-2025-32781: Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center
(updated )
Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId}.
When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can supply a valid release ID belonging to an application or namespace they are not authorized to view. The endpoint returns the release data without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...).
References
- github.com/advisories/GHSA-jxpj-9j24-w337
- github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
- github.com/apolloconfig/apollo/pull/5378
- github.com/apolloconfig/apollo/releases/tag/v2.5.0
- github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337
- nvd.nist.gov/vuln/detail/CVE-2025-32781
Code Behaviors & Features
Detect and mitigate CVE-2025-32781 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →