CVE-2025-27507

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

State: Published
Severity: 9.0 Critical
Published: Mar 4, 2025
Updated: Mar 12, 2025
Reserved: Feb 26, 2025

Description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
zitadelzitadel	>= 2.63.0-rc.1, < 2.63.8Affected >= 2.64.0-rc.1, < 2.64.5Affected >= 2.66.0-rc.1, < 2.66.11Affected >= 2.67.0-rc.1, < 2.67.8Affected >= 2.68.0-rc.1, < 2.68.4Affected >= 2.69.0-rc.1, < 2.69.4Affected >= 2.70.0-rc.1, < 2.70.1Affected >= 2.65.0-rc.1, < 2.65.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.