Apollo Portal’s release endpoint does not verify application or namespace permissions when a release is requested by ID while the configView.memberOnly.envs setting is enabled. A low‑privileged authenticated user who can guess or obtain a valid releaseId can read configuration data belonging to other applications and namespaces. This leads to unauthorized information disclosure and maps to authorization bypass weaknesses (CWE‑639 and CWE‑862).

All deployments of apolloconfig:apollo running a version earlier than 2.5.0 with Apollo Portal enabled and configView.memberOnly.envs set to true are affected. The vulnerability arises when the /envs/{env}/releases/{releaseId} endpoint is reachable and users have permission to perform GET requests on release IDs. Any such installation, regardless of the number of applications or namespaces, is at risk if low‑privileged users can access the endpoint.

The CVSS score of 6.5 signifies moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation guess of a releaseId, with no elevated privileges needed. The likely attack vector is a standard HTTP GET request to /env}.