UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27507

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

Severity
Critical 9.0
Published
4 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.65.6, 2.66.11, 2.67.8, 2.68.4, 2.69.4, 2.70.1
Also known as
GHSA-f3gh-529w-v32x
Sources
NVD, Project advisories (GitHub)

Description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.70.0 before 2.70.1
  • From 2.69.0 before 2.69.4
  • From 2.68.0 before 2.68.4
  • From 2.67.0 before 2.67.8
All 8 release lines
  • Every version before 2.63.8
  • From 2.64.0 before 2.64.5
  • From 2.65.0 before 2.65.6
  • From 2.66.0 before 2.66.11
  • From 2.67.0 before 2.67.8
  • From 2.68.0 before 2.68.4
  • From 2.69.0 before 2.69.4
  • From 2.70.0 before 2.70.1
ZITADELServers and applications · github:zitadel/zitadel
  • Every version before 2.63.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27507
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27507
  • GitHub Advisory Database https://github.com/advisories/GHSA-f3gh-529w-v32x
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x