Incorrect Authorization Vulnerability in Apache APISIX by Apache
CVE-2026-124716

6.4MEDIUM

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124716?

An incorrect authorization vulnerability exists in Apache APISIX, where an authenticated user with specific route permissions can access protected upstreams without fulfilling all authorization requirements. This can lead to unauthorized actions if an attacker can exploit the flawed permission checks to bypass security measures. Users are advised to upgrade to version 3.20.0 to mitigate this vulnerability.

Affected Version(s)

Apache APISIX 1.4.0 <= 3.19.0

References

https://lists.apache.org/thread/5kyz1fdbgx9to7lj654wqf72y...
vendor-advisory

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erjey (Independent Security Researcher)
shreemaan-abhishek
shreemaan-abhishek
.