CVE-2025-32781
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In Apollo Portal prior to version 2.5.0, a vulnerability exists due to missing permission checks for applications and namespaces when fetching a release by its ID. An authenticated low-privileged user can read configuration data from other applications if they know or guess a valid releaseId, bypassing the UserPermissionValidator.shouldHideConfigToCurrentUser(...) mechanism.
Risk Assessment
The risk involves unauthorized access to sensitive configuration data of other applications and namespaces, potentially leading to exposure of secrets such as passwords, API keys, or service endpoints.
Recommendation
Immediately upgrade Apollo to version 2.5.0 or later, which includes the fix for this vulnerability. Until the update is applied, restrict access to the Portal interface and monitor requests to the GET /envs/{env}/releases/{releaseId} endpoint.
Other vulnerabilities in Apollo
See all- CVE-2026-59955High
Apollo ConfigService before version 2.5.2 may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled. The issue stems from incorrect parsing of the request path /configfiles/raw/{appId}/{clusterName}/{namespace}, where the application ID is read as 'raw' instead of the actual value from the URL, potentially bypassing signature verification for the target application.
- CVE-2026-59954High
Apollo ConfigService prior to version 2.5.2 may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. This occurs because ConfigService accepts non-canonical appId variants (e.g., accent or trailing-space variants) during authentication, which are later resolved to the protected app on /configs and /configfiles endpoints.
Original NVD description (English source)
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.