5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67717

CVE-2025-67717: Zitadel Discloses the Total Number of Instance Users

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67717

CVE-2025-67717:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel	go	>= 4.0.0-rc.1, <= 4.7.1	4.7.2
github.com/zitadel/zitadel	go	>= 2.44.0, <= 3.4.4	3.4.5
github.com/zitadel/zitadel	go	< 1.80.0-v2.20.0.20251210121356-826039c6208f	1.80.0-v2.20.0.20251210121356-826039c6208f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch for the Zitadel vulnerability reveals that the root cause of the information disclosure is in the internal/query/user.go file. Specifically, the SearchUsers function was fetching a list of users and their total count from the database and then applying permission-based filtering on the returned list. However, the total count was not being recalculated after the filtering. This meant that any authenticated user could query the ListUsers endpoint and, while receiving an empty or filtered list of users in the response, the totalResult field would contain the total number of users in the entire Zitadel instance.

The patch addresses this by removing the usersCheckPermission function, which was responsible for the insecure post-query filtering. The logic is changed to incorporate permission checks directly into the database query itself (within the searchUsers function, which is called by SearchUsers). This ensures that the database returns only the users the requester has permission to see, and the count is also calculated based on this filtered set. The changes in the integration tests, where the expected totalResult is now explicitly checked against a known value instead of being copied from the response, further confirm that the fix correctly calculates the total number of visible users.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.