CVE-2025-32781— Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| apolloconfig | apollo | < 2.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-32781
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId
Source: CVE Program / CVE List V5
Vulnerability Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Apollo 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apollo Apollo是Apollo公司的一个可靠的配置管理系统。 Apollo 2.5.0之前版本存在授权问题漏洞，该漏洞源于Apollo Portal在configView.memberOnly.envs启用时，通过GET /envs/{env}/releases/{releaseId}请求发布版本时未验证应用和命名空间权限，可能导致低权限Portal用户在获取或猜测到有效releaseId后，从其他应用和命名空间读取配置数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apolloconfig | apollo | < 2.5.0 | - |
II. Public POCs for CVE-2025-32781
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-32781
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-32781 (2)
Vendor Advisories for CVE-2025-32781 (1)
Vendor Pages for CVE-2025-32781 (1)
- 🔗 Release Apollo 2.5.0 Release · apolloconfig/apollo · GitHubx_refsource_MISC
Same Patch Batch · apolloconfig · 2026-07-15 · 3 CVEs total
| CVE-2026-59955 | 7.5 HIGH | Apollo ConfigService access key authentication bypass via raw config file appId parsing |
| CVE-2026-59954 | 7.5 HIGH | Apollo ConfigService access key authentication bypass via appId parsing and non-canonical |
IV. Related Vulnerabilities
Same product: apollo
- CVE-2026-59954
Apollo ConfigService access key authentication bypass via ap - CVE-2026-59955
Apollo ConfigService access key authentication bypass via ra - CVE-2025-20002
GMOD Apollo Generation of Error Message Containing Sensitive - CVE-2025-24924
GMOD Apollo Missing Authentication for Critical Function - CVE-2025-23410
GMOD Apollo Relative Path Traversal
Same vendor: apolloconfig
- CVE-2026-59954
Apollo ConfigService access key authentication bypass via ap - CVE-2026-59955
Apollo ConfigService access key authentication bypass via ra - CVE-2024-43397
Potential unauthorized access issue in apollo-portal - CVE-2023-25570
Apollo has potential access control security issue in eureka - CVE-2023-25569
apollo-portal has potential CSRF issue
Same weakness: CWE-639
- CVE-2026-77780
Unvalidated bank account and card foreign keys in the Prospe - CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM tran - CVE-2026-77776
Headroom Proxy Treats the Client-Supplied x-headroom-user-id - CVE-2026-77769
OpenPanel report.list Queries Reports by an Unverified dashb - CVE-2026-77768
OpenPanel report.get Returns Any Report by Identifier Withou
V. Comments for CVE-2025-32781
No comments yet