PT-2025-50564 · Zitadel · Zitadel

Published 2025-12-10 · Updated 2026-01-06 · CVE-2025-67717

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.44.0 through 3.4.4 ZITADEL versions 4.0.0-rc.1 through 4.7.1

Description ZITADEL, an open-source identity infrastructure tool, reveals the total number of instance users to authenticated users, irrespective of their permissions. This information disclosure occurs through the totalResult field. While individual user data or personally identifiable information (PII) is not exposed, disclosing the total user count may be sensitive in certain situations.

Recommendations Update to ZITADEL version 3.4.5 or later. Update to ZITADEL version 4.7.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-67717

GHSA-F4CF-9RVR-2RCX

GO-2025-4227

SUSE-SU-2026:0037-1

Affected Products

Zitadel

References · 88

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67717.json · Exploit
• https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c · Patch
• https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4cf-9rvr-2rcx · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67717 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67717 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://suse.com/security/cve/CVE-2017-18888 · Note
• https://suse.com/security/cve/CVE-2025-34410 · Note
• https://suse.com/security/cve/CVE-2025-68942 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260037-1 · Note
• https://suse.com/security/cve/CVE-2025-67818 · Note
• https://suse.com/security/cve/CVE-2025-67495 · Note
• https://suse.com/security/cve/CVE-2025-65796 · Note