CVE-2025-32781: Apollo Portal Unauthorized Access to Configuration Data
Summary
CVE-2025-32781: Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center. Affects com.ctrip.framework.apollo:apollo versions 1.0.0 – 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo is an open-source configuration management system that helps developers manage application configurations across different environments. It provides a centralized configuration center, allowing users to easily manage and deploy configurations. The Apollo Portal is the web interface for interacting with the Apollo configuration center, enabling users to view and manage application settings. However, certain versions of Apollo Portal have a vulnerability that could allow unauthorized access to sensitive configuration data.
Vulnerability Detail
The vulnerability in Apollo Portal versions before 2.5.0 arises from inadequate permission checks when an authenticated user requests a release by ID through the endpoint GET /envs/{env}/releases/{releaseId}. Specifically, when the configView.memberOnly.envs setting is enabled, a low-privileged user can exploit this flaw by supplying a valid release ID from an application or namespace they are not authorized to access. This results in the endpoint returning sensitive configuration data without proper authorization checks, potentially exposing credentials or service endpoints. The issue does not allow modification of configurations or affect system availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate upgrade is not feasible, consider backporting the permission check from PR #5378 in the Apollo GitHub repository. Additionally, restrict access to the Apollo Portal to trusted users until the fix is deployed.
Conclusion
The CVE-2025-32781 vulnerability in Apollo Portal poses a risk of unauthorized access to sensitive configuration data. It is crucial for users of affected versions to upgrade to version 2.5.0 or later to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
CVE-2025-32781 is a vulnerability in Apollo Portal that allows unauthorized access to configuration data due to insufficient permission checks.
Apollo Portal versions earlier than 2.5.0 are affected when the configView.memberOnly.envs setting is enabled.
An attacker can access sensitive configuration data, including credentials and service endpoints, from applications and namespaces they are not authorized to view.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
