PT-2025-49328 · Google · Apigee-X

Omer Amiad · Published 2025-12-06 · Updated 2026-02-03 · CVE-2025-13292

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Clear

Name of the Vulnerable Software and Affected Versions Apigee-X versions prior to 1-16-0-apigee-3

Description A security issue in Apigee-X could allow an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. The issue involves cross-tenant access, potentially exposing sensitive information such as JSON Web Tokens (JWTs) of end users.

Recommendations Update to version 1-16-0-apigee-3 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13292

Affected Products

Apigee-X

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13292 · Security Note
• https://t.me/cveNotify/150284 · Telegram Post
• https://t.me/cveNotify/150449 · Telegram Post
• https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability · Note
• https://twitter.com/GoogleVRP/status/2018734572452904980 · Twitter Post
• https://focalsecurity.io/blog/gatewaytoheaven-gcp-cross-tenant-vulnerability · Note
• https://twitter.com/omer_asfu/status/2018370967571943455 · Twitter Post
• https://twitter.com/CVEnew/status/1997178083942465607 · Twitter Post
• https://docs.cloud.google.com/apigee/docs/release-notes#October_16_2025 · Note
• https://t.me/cveNotify/144996 · Telegram Post