CVE-2025-14561
CriticalCVSS 9.0Summary
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Risk Assessment
In a multi-tenant environment, a privileged user from one tenant can access or modify API configurations of other tenants, leading to data confidentiality and integrity breaches.
Recommendation
Review tenant isolation configuration and ensure Publisher REST APIs enforce proper access controls. Limit user privileges and consider implementing additional authorization mechanisms.
Original NVD description (English source)
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.