title: security vulnerability on unauthorized access.
description: In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
product: Apache APISIX Dashboard
vendor: Apache Software Foundation
versions:
status: affected, version: 2.7 and 2.7.1
status: affected, version: 2.8
status: affected, version: 2.9
status: affected, version: 2.10
}
metrics:
other: [
content: {'other': 'high'}
type: unknown
]
workarounds: Implement one of the following mitigation techniques:
1. Upgrade to release 2.10.1
2. Change the default username and password, restrict the source IP to access the Apache APISIX Dashboard