Apollo, a configuration management system, suffers from an authorization bypass vulnerability (CWE-639, CWE-862) in versions before 2.5.0. Specifically, the Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID via the GET /envs/{env}/releases/{releaseId} endpoint if configView.memberOnly.envs is enabled. This allows a low-privileged user who can obtain or guess a valid releaseId to read configuration data from other applications and namespaces without invoking the UserPermissionValidator.shouldHideConfigToCurrentUser(...) method. The vulnerability is addressed in Apollo version 2.5.0.

An attacker with low privileges who is authenticated to the Apollo Portal can access sensitive configuration data belonging to other applications and namespaces by exploiting the lack of permission verification on release ID requests. This can lead to unauthorized disclosure of configuration information, which may include sensitive or confidential data. The vulnerability does not impact integrity or availability but has a high confidentiality impact.

Upgrade Apollo to version 2.5.0 or later, where this authorization bypass vulnerability has been fixed. No other mitigations are indicated in the advisory.