CVE-2025-67717CWE-497

CVE-2025-67717

Medium · published December 11, 2025

CVSS v3.1

4.3

EPSS

Percentile

12.2

In the wild

Unconfirmed

What it is

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00222 · 12.2th percentile
Weakness: CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published: 2025-12-11T06:16Z

Affected products (3)

Product	Versions	Fixed in
zitadel/zitadel	≥ 2.44.0, ≤ 2.71.19	—
zitadel/zitadel	≥ 3.0.0, < 3.4.5	3.4.5
zitadel/zitadel	≥ 4.0.0, < 4.7.2	4.7.2

References (2)

https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c · [email protected]https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx · [email protected]

EPSS history

Timeline

11 DEC 00:30Z
Zitadel Discloses the Total Number of Instance Users
cvelistv5