CVE Feed

    Dashboard / CVE / CVE-2025-32781

    CVE-2025-32781

    Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.

    Published:Jul 15, 2026
    Last Modified:Jul 15, 2026
    EPS:Jul 15, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Apolloconfig
    Product
    Apollo

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-59954 (CVSS 7.5) — Apollo is a reliable configuration management system suitable for microservice configuration management scenar…
    CVE-2026-59955 (CVSS 7.5) — Apollo is a reliable configuration management system suitable for microservice configuration management scenar…
    CVE-2024-43397 (CVSS 4.3) — Apollo is a configuration management system. A vulnerability exists in the synchronization configuration featu…
    CVE-2024-42662 (CVSS 7.5) — An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted…
    CVE-2022-4962 (CVSS 4.3) — A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some …
    CVE-2023-25570 (CVSS 7.5) — Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if us…
    CVE-2023-25569 (CVSS 5.7) — Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a specia…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High