Read the docs
TI-2025-16993 Aliases CVE-2025-23208GHSA-c9p4-xwr9-rfhx

IdP group membership revocation ignored in zot

Priority HIGH 71CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0042 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed zot (project-zot): 2.1.2zotregistry.dev/zot (Go): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
project-zotzotbefore 2.1.22.1.2Patch availableCNA
—zotregistry.dev/zot (Go)before 2.1.22.1.2Patch availableGHSA-c9p4-xwr9-rfhx
  • zot Vendorproject-zot Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
  • zotregistry.dev/zot (Go) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-c9p4-xwr9-rfhx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:*before 2.1.2Vulnerableproject-zot
  • cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:* Versions before 2.1.2 Vulnerable ·project-zot

Remediation

  • Fix · CNA zot (project-zot) Fixed in 2.1.2
  • Fix · GHSA-c9p4-xwr9-rfhx zotregistry.dev/zot (Go) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23208
  2. 2026-10-03 Alias added: GHSA-c9p4-xwr9-rfhx

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-24356 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) CVSS 3.1HIGH 7.7
  • TI-2024-26792 Cache driver GetBlob() allows read access to any blob without access control check CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences