ثغرة أمنية في مكوّن برمجي — CVE-2025-8325

تؤثر هذه الثغرة الموثقة في wso2 api control plane, wso2 api manager, wso2 traffic manager. يوضح سجل NVD أن المشكلة تتمثل في: The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.