CVE-2025-67717: 
NixOS vulnerability analysis and mitigation

CVE-2025-67717 is an information disclosure vulnerability in ZITADEL, an open-source identity infrastructure platform, where the User Service exposes the total number of instance users to any authenticated user regardless of their specific permissions. The vulnerability affects versions 2.44.0 through 2.71.19, 3.0.0-rc.1 through 3.4.4, and 4.0.0-rc.1 through 4.7.1. It was discovered by zentrust partners GmbH during a scheduled penetration test and disclosed on December 10, 2025. The CVSS v4 base score is 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The ZITADEL User Service fails to enforce permission-scoped filtering on the totalResult field returned by user listing API calls, causing it to return the total count of all instance users rather than only those the querying user has read access to. An attacker with any valid authenticated session can trigger this by querying the User Service API endpoint; no elevated privileges are required beyond basic authentication. The fix, applied in commit 826039c, enforces v2 permission checks on user listing so that totalResult reflects only users the caller is authorized to view (GitHub Advisory, Patch Commit).

The vulnerability has a limited confidentiality impact — no individual user data, PII, or credentials are exposed. However, leaking the total user count via the totalResult field can assist attackers in reconnaissance by revealing the scale of an organization's user base, which may be considered sensitive in competitive, regulated, or security-conscious environments. There is no integrity or availability impact, and no direct path to lateral movement or privilege escalation from this vulnerability alone (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034% (11th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated session, making it low-complexity but limited in impact (Github Advisory, Feedly).

1. Obtain authentication: Acquire any valid authenticated session or access token for the target ZITADEL instance (e.g., via a self-registered account or existing low-privilege credentials).
2. Query the User Service API: Send an authenticated API request to the ZITADEL User Service listing endpoint (e.g., GET /v2/users or the equivalent gRPC/connectRPC call) with a valid Bearer token.
3. Extract totalResult: Parse the API response and read the totalResult field, which incorrectly returns the total number of all users in the instance rather than only those the caller has permission to view.
4. Use for reconnaissance: Use the disclosed user count to infer the scale of the organization's identity infrastructure, potentially informing further targeted attacks (GitHub Advisory).

• Logs: Repeated authenticated API requests to user listing endpoints (e.g., /v2/users, /v2beta/users) from accounts that do not normally perform administrative or user management operations; access log entries showing low-privilege accounts querying user listing APIs.
• Network: Unusual volume of user listing API calls from a single authenticated session or IP address, particularly from accounts with no legitimate need to enumerate users.

ZITADEL has released patched versions addressing this vulnerability: upgrade to 4.7.2 for the 4.x branch, 3.4.5 for the 3.x branch, and 3.4.5 (or the patch build 1.80.0-v2.20.0.20251210121356-826039c6208f) for the 2.x branch. If an immediate upgrade is not feasible, administrators can enable the permissionCheckV2 feature flag on their instance as a workaround, which enforces stricter permission checks on user listing. Upgrading to a patched version is the recommended long-term solution (GitHub Advisory, Github Advisory).

The vulnerability was discovered by analysts Martin Tschirsich, Joud Zakharia, and Christopher Baumann at zentrust partners GmbH during a scheduled penetration test, and responsibly disclosed to ZITADEL. The ZITADEL security team acknowledged the finding and published the advisory on December 10, 2025. No significant broader media coverage or notable community controversy has been observed, consistent with the moderate severity and limited impact of the vulnerability (GitHub Advisory).