CVE-2023-25569: Apolloconfig Apollo

Medium severity, CVSS 5.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

Affected products

• Apolloconfig Apollo: before 2.1.0 (fixed in 2.1.0)

Published 2023-02-20. Last modified 2026-06-17.