CVE-2025-67717

Zitadel Discloses the Total Number of Instance Users

Medium5.3EPSS 0.22%

Published: 11 Dec 2025
Updated: 11 Dec 2025
Reserved: 10 Dec 2025
Assigned by: GitHub_M

Description

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.

Timeline

2025
10 Dec 2025
10 Dec 2025
ID reserved
By GitHub_M
11 Dec 20251 day later
11 Dec 2025· 1 day later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-67717, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.22% · top 87% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere (opens in a new tab)All about CWE-497 and its CVEs

Affected products

zitadel · zitadel
- affected < 1.80.0-v2.20.0.20251210
- affected >= 2.44.0, < 3.4.5
- affected >= 4.0.0-rc.1, < 4.7.2

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Gogithub.com/zitadel/zitadelGHSA-f4cf-9rvr-2rcx (opens in a new tab)

References (2)

https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx (opens in a new tab)x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-67717](https://trackcve.app/badge/CVE-2025-67717.svg)](https://trackcve.app/cve/CVE-2025-67717)

Record last updated 11 Dec 2025, 18:43 UTC.