{"cve":"CVE-2025-27507","nvd":{"published":"2025-03-04T17:15:20.360","modified":"2026-06-17T09:03:43.580","status":"Analyzed","description":"The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","score":9.0},"cwes":["CWE-639"],"references":["https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4","https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x"],"products":["zitadel:zitadel"],"source":"nvd","synced_at":"2026-10-19T22:00:17.429720821+00:00"},"epss":{"cve":"CVE-2025-27507","score":0.00609,"percentile":0.49196,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-f3gh-529w-v32x","url":"https://osv.dev/vulnerability/GHSA-f3gh-529w-v32x","summary":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations","modified":"2025-03-11T17:18:47Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":["<2.63.8"],"fixed":["2.63.8"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.64.0 <2.64.5"],"fixed":["2.64.5"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.65.0 <2.65.6"],"fixed":["2.65.6"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.66.0 <2.66.11"],"fixed":["2.66.11"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.67.0 <2.67.8"],"fixed":["2.67.8"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.68.0 <2.68.4"],"fixed":["2.68.4"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.69.0 <2.69.4"],"fixed":["2.69.4"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel/v2","purl":"pkg:golang/github.com/zitadel/zitadel/v2","ranges":[">=2.70.0 <2.70.1"],"fixed":["2.70.1"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<2.63.8"],"fixed":["2.63.8"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.64.0 <2.64.5"],"fixed":["2.64.5"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.65.0 <2.65.6"],"fixed":["2.65.6"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.66.0 <2.66.11"],"fixed":["2.66.11"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.67.0 <2.67.8"],"fixed":["2.67.8"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.68.0 <2.68.4"],"fixed":["2.68.4"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.69.0 <2.69.4"],"fixed":["2.69.4"]},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":[">=2.70.0 <2.70.1"],"fixed":["2.70.1"]}]},{"id":"GO-2025-3499","url":"https://osv.dev/vulnerability/GO-2025-3499","summary":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel","modified":"2025-03-10T21:27:05.040791Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}