Security Flaw in Apollo Portal Affects Microservice Configuration Management
CVE-2025-32781
6.5MEDIUM
What is CVE-2025-32781?
Apollo Portal, a configuration management system designed for microservice environments, has a vulnerability that does not properly verify application and namespace permissions for authenticated users. Specifically, prior to version 2.5.0, a low-privileged user can request a release by ID through the API endpoint GET /envs/{env}/releases/{releaseId} even when the configView.memberOnly.envs option is enabled. This flaw allows such users to access configuration data from other applications and namespaces, exposing sensitive information without proper authorization checks. This issue has been addressed in version 2.5.0.
Affected Version(s)
apollo < 2.5.0