CVE-2025-67717
Last modified
CVE-2025-67717 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zitadel | Zitadel | >= 2.44.0, <= 2.71.19 |
| Zitadel | Zitadel | >= 3.0.0, < 3.4.5 |
| Zitadel | Zitadel | >= 4.0.0, < 4.7.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-67717?
How severe is CVE-2025-67717?
How do I fix CVE-2025-67717?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-67710There is a stored cross site scripting issue in Esri ArcGIS …6.1
- CVE-2025-67711There is a stored cross site scripting issue in Esri ArcGIS …6.1
- CVE-2025-67712There is an HTML injection issue in Esri ArcGIS Web AppBuild…4.7
- CVE-2025-67713Miniflux 2 is an open source feed reader. Versions 2.2.14 an…6.1
- CVE-2025-67715Weblate is a web based localization tool. In versions prior …4.3
- CVE-2025-67716The Auth0 Next.js SDK is a library for implementing user aut…5.7
- CVE-2025-67718Form.io is a combined Form and API platform for Serverless a…8.7
- CVE-2025-67719Ibexa is a composable end-to-end DXP (Digital Experience Pla…8.5
- CVE-2025-6772A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2…7.5
- CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
- CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
- CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
Are you affected by CVE-2025-67717?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST