CVE-2025-67717

MEDIUM EPSS 9.0%
Published Dec 11, 20256mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 4.0
Medium
Find Similar
Published Dec 11, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
9.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-497

Affected Products 3

VendorProductVersionRange
zitadelzitadel*≥2.44.0  –  ≤2.71.19
zitadelzitadel*≥3.0.0  –  <3.4.5
zitadelzitadel*≥4.0.0  –  <4.7.2

References 2

  • github.com https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c
    Patch
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx
    PatchVendor Advisory

Remediation

  • github.com https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c
    Patch
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx
    PatchVendor Advisory