CVE-2025-32781: Apollo Portal Authorization Bypass in Release Controller

CVE-2025-32781 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Apollo Portal, a configuration management system for microservices, contains a security flaw where authenticated users can view sensitive configuration data they are not authorized to see. By guessing or obtaining a specific release ID, a low-privileged user can bypass permission checks to access configuration details from other applications or namespaces. This could lead to the exposure of sensitive business data, credentials, or service endpoints.

Technologies: com.ctrip.framework.apollo:apollo (Maven). Vendors: ApolloConfig, Maven.

Quick answers

Is CVE-2025-32781 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32781 being exploited in the wild.
How severe is CVE-2025-32781?
Medium severity, with a CVSS score of 6.5, published 15 July 2026.
Which products and versions are affected?
ApolloConfig Apollo Portal < 2.5.0; com.ctrip.framework.apollo:apollo (Maven) < 2.5.0, ECOSYSTEM:introduced=0.
Is there a fix for CVE-2025-32781?
A patch was published on 2025-04-11: Fix commit and pull request merged into master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32781 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-32781?
Check whether you run ApolloConfig Apollo Portal or com.ctrip.framework.apollo:apollo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the Apollo Portal 'ReleaseController' component. When the 'configView.memberOnly.envs' setting is enabled, the 'GET /envs/{env}/releases/{releaseId}' endpoint fails to invoke 'UserPermissionValidator.shouldHideConfigToCurrentUser' before returning data. An authenticated attacker with network access can exploit this by providing a valid 'releaseId' for an application or namespace they do not have permissions for, resulting in an Insecure Direct Object Reference (IDOR) that discloses configuration details. The vulnerability is resolved in version 2.5.0 by adding the necessary permission validation logic.

Affected products

  • apolloconfig Apollo Portal < 2.5.0

Identifiers

  • CVE-2025-32781
  • GHSA-jxpj-9j24-w337

Timeline

  • 2025-04-11: patched: Fix commit and pull request merged into master branch.
  • 2026-07-12: advisory: GitHub Security Advisory published.
  • 2026-07-15: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.