Zitadel Discloses the Total Number of Instance Users
Priority LOW 23CWE-497Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-497.
Summary
ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Fix Fixed zitadel (zitadel): 1.80.0-v2.20.0.20251210, 3.4.5, 4.7.2github.com/zitadel/zitadel (Go): 4.7.2, 3.4.5, 1.80.0-v2.20.0.20251210121356-826039c6208f
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zitadel | zitadel | before 1.80.0-v2.20.0.20251210; 2.44.0 to before 3.4.5; 4.0.0-rc.1 to before 4.7.2 | 1.80.0-v2.20.0.20251210, 3.4.5, 4.7.2 | Patch available | CNA |
| — | github.com/zitadel/zitadel (Go) | 4.0.0-rc.1 to before 4.7.2 | 4.7.2 | Patch available | GHSA-f4cf-9rvr-2rcx |
| — | github.com/zitadel/zitadel (Go) | 2.44.0 to before 3.4.5 | 3.4.5 | Patch available | GHSA-f4cf-9rvr-2rcx |
| — | github.com/zitadel/zitadel (Go) | before 1.80.0-v2.20.0.20251210121356-826039c6208f | 1.80.0-v2.20.0.20251210121356-826039c6208f | Patch available | GHSA-f4cf-9rvr-2rcx |
- zitadel Vendorzitadel Affected before 1.80.0-v2.20.0.20251210; 2.44.0 to before 3.4.5; 4.0.0-rc.1 to before 4.7.2 Fixed in 1.80.0-v2.20.0.20251210, 3.4.5, 4.7.2 Patch available CNA
- github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0-rc.1 to before 4.7.2 Fixed in 4.7.2 Patch available GHSA-f4cf-9rvr-2rcx
- github.com/zitadel/zitadel (Go) Vendor— Affected 2.44.0 to before 3.4.5 Fixed in 3.4.5 Patch available GHSA-f4cf-9rvr-2rcx
- github.com/zitadel/zitadel (Go) Vendor— Affected before 1.80.0-v2.20.0.20251210121356-826039c6208f Fixed in 1.80.0-v2.20.0.20251210121356-826039c6208f Patch available GHSA-f4cf-9rvr-2rcx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* | 2.44.0 – 2.71.19; 3.0.0 to before 3.4.5; 4.0.0 to before 4.7.2 | Vulnerable | zitadel |
- cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions 2.44.0 – 2.71.19; 3.0.0 to before 3.4.5; 4.0.0 to before 4.7.2 Vulnerable ·zitadel
Remediation
- Fix · CNA zitadel (zitadel) Fixed in 1.80.0-v2.20.0.20251210, 3.4.5, 4.7.2
- Fix · GHSA-f4cf-9rvr-2rcx github.com/zitadel/zitadel (Go) Fixed in 4.7.2 Advisory →
- Fix · GHSA-f4cf-9rvr-2rcx github.com/zitadel/zitadel (Go) Fixed in 3.4.5 Advisory →
- Fix · GHSA-f4cf-9rvr-2rcx github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20251210121356-826039c6208f Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67717
- 2026-10-03 Alias added: GHSA-f4cf-9rvr-2rcx
References
More Zitadel vulnerabilities
- TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
- TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
- TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
- TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
- TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
Sources
- CVE-2025-67717 · CVE Program
- CVE-2025-67717 · NVD
- FIRST EPSS
- GHSA-f4cf-9rvr-2rcx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences