CVE-2023-25569

CVE-2023-25569 describes a cross-site request forgery (CSRF) vulnerability in Apollo configuration management system versions prior to 2.1.0. A low-privileged user can craft a malicious webpage that, when visited by an authenticated portal administrator, silently assigns new roles to the attacker without the administrator's confirmation. This medium-severity vulnerability (CVSS 5.7) has a network attack vector, low attack complexity, and high impact on integrity, but no impact on confidentiality or availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.