9

CVE-2025-27507

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Zitadel ≫ Zitadel Version < 2.63.8
Zitadel ≫ Zitadel Version >= 2.64.0 < 2.64.5
Zitadel ≫ Zitadel Version >= 2.65.0 < 2.65.6
Zitadel ≫ Zitadel Version >= 2.66.0 < 2.66.11
Zitadel ≫ Zitadel Version >= 2.67.0 < 2.67.8
Zitadel ≫ Zitadel Version >= 2.68.0 < 2.68.4
Zitadel ≫ Zitadel Version >= 2.69.0 < 2.69.4
Zitadel ≫ Zitadel Version >= 2.70.0 < 2.70.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.3% 0.532
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security-advisories@github.com 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.