CVE-2025-27507
published 2025-03-04CVE-2025-27507: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure…
PriorityP353critical9CVSS 3.1
AVNACLPRHUINSCCHIHAL
EPSS
0.58%
43.5th percentile
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 0 < 2.63.8 | 2.63.8 |
| github.com | zitadel_zitadel | >= 2.64.0 < 2.64.5 | 2.64.5 |
| github.com | zitadel_zitadel | >= 2.65.0 < 2.65.6 | 2.65.6 |
| github.com | zitadel_zitadel | >= 2.66.0 < 2.66.11 | 2.66.11 |
| github.com | zitadel_zitadel | >= 2.67.0 < 2.67.8 | 2.67.8 |
| github.com | zitadel_zitadel | >= 2.68.0 < 2.68.4 | 2.68.4 |
| github.com | zitadel_zitadel | >= 2.69.0 < 2.69.4 | 2.69.4 |
| github.com | zitadel_zitadel | >= 2.70.0 < 2.70.1 | 2.70.1 |
| github.com | zitadel_zitadel_v2 | >= 0 < 2.63.8 | 2.63.8 |
| github.com | zitadel_zitadel_v2 | >= 2.64.0 < 2.64.5 | 2.64.5 |
| github.com | zitadel_zitadel_v2 | >= 2.65.0 < 2.65.6 | 2.65.6 |
| github.com | zitadel_zitadel_v2 | >= 2.66.0 < 2.66.11 | 2.66.11 |
| github.com | zitadel_zitadel_v2 | >= 2.67.0 < 2.67.8 | 2.67.8 |
| github.com | zitadel_zitadel_v2 | >= 2.68.0 < 2.68.4 | 2.68.4 |
| github.com | zitadel_zitadel_v2 | >= 2.69.0 < 2.69.4 | 2.69.4 |
| github.com | zitadel_zitadel_v2 | >= 2.70.0 < 2.70.1 | 2.70.1 |
| zitadel | zitadel | < 2.63.8 | 2.63.8 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
osv·2025-03-10
CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/zitadel/zitadel before v2.63.8, from v2.64.0 before v2.64.5, from v2.65.0 before v2.65.6, from v2.66.0 before v2.66.11, from v2.67.0 before v2.67.8, from v2.68.0 before v2.68.4, from v2.69.0 before v2.69.4, from v2.70.0 before v2.70.1.
GHSA
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
ghsa·2025-03-04
CVE-2025-27507 [CRITICAL] CWE-639 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
### Summary
ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, we still strongly recommend upgrading to the patched version to address all identified issues.
### Description
ZITADEL's Admin API, intended for managing ZITADEL instances, contains 12 HTTP endpoints that are unexpectedly accessible to authenticated ZITADEL users who
OSV
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
osv·2025-03-04
CVE-2025-27507 [CRITICAL] IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
### Summary
ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, we still strongly recommend upgrading to the patched version to address all identified issues.
### Description
ZITADEL's Admin API, intended for managing ZITADEL instances, contains 12 HTTP endpoints that are unexpectedly accessible to authenticated ZITADEL users who
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-04
Published