« Volver al listado

CVE-2025-27507

Estado: AnalizadaCrítica (9)—

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

IDOR en Admin API remota (PR:H) permite manipular configuraciones LDAP y objetos sin roles específicos. Afecta gestión de cuentas, autenticación y acceso privilegiado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningUser TrainingThreat Intelligence ProgramPrivileged Process IntegrityNetwork Segmentation

Tecnologías afectadas (1)

Zitadel — Zitadel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27507",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27507",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-04T17:05:51.380213Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.63.0-rc.1, < 2.63.8"
            },
            {
              "status": "affected",
              "version": ">= 2.64.0-rc.1, < 2.64.5"
            },
            {
              "status": "affected",
              "version": ">= 2.66.0-rc.1, < 2.66.11"
            },
            {
              "status": "affected",
              "version": ">= 2.67.0-rc.1, < 2.67.8"
            },
            {
              "status": "affected",
              "version": ">= 2.68.0-rc.1, < 2.68.4"
            },
            {
              "status": "affected",
              "version": ">= 2.69.0-rc.1, < 2.69.4"
            },
            {
              "status": "affected",
              "version": ">= 2.70.0-rc.1, < 2.70.1"
            },
            {
              "status": "affected",
              "version": ">= 2.65.0-rc.1, < 2.65.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-04T17:15:20.360",
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8."
    },
    {
      "lang": "es",
      "value": "El software de infraestructura de identidad de código abierto Zitadel permite a los administradores desactivar el autorregistro de usuarios. La API de administración de ZITADEL contiene vulnerabilidades de referencia directa a objetos inseguros (IDOR) que permiten a los usuarios autenticados, sin roles de IAM específicos, modificar configuraciones confidenciales. Si bien varios endpoints se ven afectados, la vulnerabilidad más crítica radica en la capacidad de manipular configuraciones LDAP. Los clientes que no utilizan LDAP para la autenticación no corren el riesgo de sufrir los aspectos más graves de esta vulnerabilidad. Sin embargo, se recomienda encarecidamente actualizar a la versión parcheada para solucionar todos los problemas identificados. Esta vulnerabilidad se ha corregido en 2.71.0, 2.70.1, 2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5 y 2.63.8."
    }
  ],
  "lastModified": "2026-06-17T09:03:43.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B690DF1-4800-491C-BC5D-7287890A7E3D",
              "versionEndExcluding": "2.63.8"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31116250-F48A-4797-A411-094DE5F8B3D1",
              "versionEndExcluding": "2.64.5",
              "versionStartIncluding": "2.64.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E7945E2-B63C-435E-8A2F-3B9E7DEBF906",
              "versionEndExcluding": "2.65.6",
              "versionStartIncluding": "2.65.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09FAFF93-5ADF-48BB-BE4F-612CA7327869",
              "versionEndExcluding": "2.66.11",
              "versionStartIncluding": "2.66.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C8B912-6B33-4515-BC70-22B0277A7B5E",
              "versionEndExcluding": "2.67.8",
              "versionStartIncluding": "2.67.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D041D8D-C26D-4F18-A153-82CACFAF4DB5",
              "versionEndExcluding": "2.68.4",
              "versionStartIncluding": "2.68.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD674356-5110-4841-906E-29A85C0A4DF6",
              "versionEndExcluding": "2.69.4",
              "versionStartIncluding": "2.69.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C535AA7-1466-4CB5-ACB5-35523DC6D387",
              "versionEndExcluding": "2.70.1",
              "versionStartIncluding": "2.70.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}