Is CVE-2025-8325 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8325 being exploited in the wild.

How severe is CVE-2025-8325?

Medium severity, with a CVSS score of 6.3, published 11 May 2026.

Which products and versions are affected?

Wso2 API Control Plane 4.5.0, 4.5.0 to 4.5.0.18; Wso2 API Manager 3.2.0 to 3.2.0.435, 3.2.1 to 3.2.1.55, 4.0.0 to 4.0.0.355, 4.1.0 to 4.1.0.219, 4.2.0 to 4.2.0.157, 4.3.0 to 4.3.0.70, 4.4.0 to 4.4.0.33, 4.5.0 to 4.5.0.17, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0; Wso2 Traffic Manager 4.5.0, 4.5.0 to 4.5.0.17; Wso2 Universal Gateway 4.5.0, 4.5.0 to 4.5.0.17.

Is there a fix for CVE-2025-8325?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-8325 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-8325?

Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8325: WSO2 API Manager RBAC bypass in Gateway API

CVE-2025-8325 · Severity: medium · CVSS 6.3 · Published 2026-05-11

WSO2 API Manager and related components fail to properly restrict access to certain administrative and gateway interfaces. This allows any user with a basic account to perform sensitive operations that should be reserved for administrators, potentially leading to unauthorized configuration changes or service disruption. In older versions (3.x), this may also expose internal service interfaces to the public internet.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2025-8325 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8325 being exploited in the wild.
How severe is CVE-2025-8325?: Medium severity, with a CVSS score of 6.3, published 11 May 2026.
Which products and versions are affected?: Wso2 API Control Plane 4.5.0, 4.5.0 to 4.5.0.18; Wso2 API Manager 3.2.0 to 3.2.0.435, 3.2.1 to 3.2.1.55, 4.0.0 to 4.0.0.355, 4.1.0 to 4.1.0.219, 4.2.0 to 4.2.0.157, 4.3.0 to 4.3.0.70, 4.4.0 to 4.4.0.33, 4.5.0 to 4.5.0.17, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.1, 3.2.0; Wso2 Traffic Manager 4.5.0, 4.5.0 to 4.5.0.17; Wso2 Universal Gateway 4.5.0, 4.5.0 to 4.5.0.17.
Is there a fix for CVE-2025-8325?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-8325 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-8325?: Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper preservation of permissions (CWE-281) exists in the Gateway and Internal Service APIs of WSO2 API Manager and related products. The software fails to enforce role-based access controls (RBAC), allowing users with the 'Internal/Everyone' role to invoke sensitive REST API endpoints. An authenticated attacker with low privileges can bypass intended permission checks to perform sensitive operations against the Gateway REST API. In WSO2 APIM 3.x versions, this vulnerability also extends to Internal Service APIs which may be externally accessible. Fixes are available via WSO2 update levels or public GitHub pull requests for community users.

Affected products

WSO2 API Manager 3.2.0 to 3.2.0.435, 3.2.1 to 3.2.1.55, 4.0.0 to 4.0.0.355, 4.1.0 to 4.1.0.219, 4.2.0 to 4.2.0.157, 4.3.0 to 4.3.0.70, 4.4.0 to 4.4.0.33, 4.5.0 to 4.5.0.17
WSO2 API Control Plane 4.5.0 to 4.5.0.18
WSO2 Traffic Manager 4.5.0 to 4.5.0.17
WSO2 Universal Gateway 4.5.0 to 4.5.0.17

Timeline

2026-01-26: advisory: Initial vendor advisory published
2026-05-11: disclosed: CVE published to NVD

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4401/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.