CVE-2025-64431
published 2025-11-07CVE-2025-64431: Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks…
PriorityP352high8.7CVSS 4.0
AVNACLATNPRLUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.25%
16.5th percentile
Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 1.80.0-v2.20.0.20250414095945-f365cee73242 < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 | 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 |
| github.com | zitadel_zitadel | >= 4.0.0-rc.1 < 4.6.3 | 4.6.3 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel
osv·2025-11-17
CVE-2025-64431 IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/zitadel/zitadel from v4.0.0-rc.1 before v4.6.3.
OSV
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
osv·2025-11-05
CVE-2025-64431 [HIGH] IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
### Summary
ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.
### Impact
ZITADEL's Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.
This could allow an attacker to:
- **Read** organization data, inc
GHSA
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
ghsa·2025-11-05
CVE-2025-64431 [HIGH] CWE-639 IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
### Summary
ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.
### Impact
ZITADEL's Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.
This could allow an attacker to:
- **Read** organization data, inc
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-07
Published