What is CVE-2025-67717?

CVE-2025-67717 is a medium-severity vulnerability in Zitadel, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 4.3/10. Published 2025-12-11.

How severe is CVE-2025-67717?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Zitadel

CVE-2025-67717

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this doe…

EPSS: 0.002 (9.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Zitadel — versions < 1.80.0-v2.20.0.20251210, >= 2.44.0, < 3.4.5, >= 4.0.0-rc.1, < 4.7.2

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-67717?: CVE-2025-67717 is a medium-severity vulnerability in Zitadel, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 4.3/10. Published 2025-12-11.
How severe is CVE-2025-67717?: Medium severity. CVSS v3 base score is 4.3 out of 10.