High severity · published Dec 6, 2025
CVE-2025-13292
Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations.
Apigee-X was found to be vulnerable.
This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apigee-X · Google Cloud
before 1-16-0-apigee-3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13292
docs.cloud.google.com
https://docs.cloud.google.com/apigee/docs/release-notes#October_16_2025
focalsecurity.io
https://focalsecurity.io/blog/gatewaytoheaven-gcp-cross-tenant-vulnerability/
More from Apigee-X
9.2
CVE-2026-2264
Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.