CVE-2025-66390: n/a

CVE-2025-66390 describes a configuration issue in Microsoft Azure API Management's self-service signup API endpoint, which accepts cross-tenant requests despite signup being disabled in the UI for certain tenants. Attackers can manipulate the hostname or tenant identifier to reuse the registration flow for tenants with signup disabled. The vendor states this is a configuration/state issue that does not cross security boundaries or compromise tenant isolation. The vulnerability is rated critical with a CVSS 3.1 score of 9.8. Since this is a cloud service, remediation is managed by Microsoft.

The vulnerability allows an attacker to bypass UI restrictions on tenant signup by sending cross-tenant requests to the self-service signup API endpoint. However, it does not break tenant isolation or cross security boundaries, limiting the scope of impact to configuration misuse. Confidentiality, integrity, and availability impacts are rated high per CVSS, but the vendor's statement suggests no direct compromise of tenant data isolation.

Microsoft manages remediation for this cloud-hosted service and has indicated that a patch or fix is available. Users should monitor official Microsoft Azure advisories for updates and ensure their tenant configurations align with recommended settings. No additional immediate action is required by tenants as the vendor handles the fix.