CVE-2025-32781

Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Published Jul 15, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.

Analysis

Technical impact

Apollo Portal’s release endpoint does not verify application or namespace permissions when a release is requested by ID while the configView.memberOnly.envs setting is enabled. A low‑privileged authenticated user who can guess or obtain a valid releaseId can read configuration data belonging to other applications and namespaces. This leads to unauthorized information disclosure and maps to authorization bypass weaknesses (CWE‑639 and CWE‑862).

Affected Systems

All deployments of apolloconfig:apollo running a version earlier than 2.5.0 with Apollo Portal enabled and configView.memberOnly.envs set to true are affected. The vulnerability arises when the /envs/{env}/releases/{releaseId} endpoint is reachable and users have permission to perform GET requests on release IDs. Any such installation, regardless of the number of applications or namespaces, is at risk if low‑privileged users can access the endpoint.

Risk and Exploitability

The CVSS score of 6.5 signifies moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation guess of a releaseId, with no elevated privileges needed. The likely attack vector is a standard HTTP GET request to /env}.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

apolloconfig

apollo

affected

Version	Status	Constraints
`< 2.5.0`	affected	—

No data.

Vendor Product Versions

Apolloconfig

Apollo

Version	Status	Scheme	Platform
`[0,2.5.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apollo to version 2.5.0 or later, which adds the missing permission check.
If an upgrade cannot be performed immediately, disable the configView.memberOnly.envs setting to prevent unprivileged users from accessing release IDs of other applications.
Enforce stricter permission checks on the /envs/{env}/releases/{releaseId} endpoint, or temporarily block access for users who do not require release reading capabilities until the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 03:19 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-jxpj-9j24-w337	Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.415% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291
https://github.com/apolloconfig/apollo/pull/5378
https://github.com/apolloconfig/apollo/releases/tag/v2.5.0
https://github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337

History

Jul 15, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apolloconfig Apolloconfig apollo
Vendors & Products		Apolloconfig Apolloconfig apollo

Jul 15, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
Title		Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId
Weaknesses		CWE-639 CWE-862
References		https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291 https://github.com/apolloconfig/apollo/pull/5378 https://github.com/apolloconfig/apollo/releases/tag/v2.5.0 https://github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`