-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | >= 4.0.0-rc.1, <= 4.7.1 | 4.7.2 |
| github.com/zitadel/zitadel | go | >= 2.44.0, <= 3.4.4 | 3.4.5 |
| github.com/zitadel/zitadel | go | < 1.80.0-v2.20.0.20251210121356-826039c6208f | 1.80.0-v2.20.0.20251210121356-826039c6208f |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the SearchUsers function in internal/query/user.go. This function was responsible for fetching users from the database. The core of the issue is that it performed permission checking as a post-processing step on the results, but it failed to update the totalResult field, which had been calculated before this filtering. This meant that any authenticated user could call the ListUsers API endpoint and, while they would only receive the user data they were permitted to see, the totalResult field in the response would reveal the total number of users in the entire ZITADEL instance.
The patch addresses this by removing the post-query filtering logic (usersCheckPermission function) and instead enforcing permission checks directly within the database query by default when a permission check is required. This ensures that the database itself only returns the records the user is authorized to access, and therefore the count is inherently correct and reflects the filtered data set.
The analysis of the patch, particularly the changes in internal/query/user.go, confirms this was the root cause. The modifications in the integration test files (internal/api/grpc/user/v2/integration_test/query_test.go and internal/api/grpc/user/v2beta/integration_test/query_test.go) for the ListUsers tests corroborate this by showing adjustments to how the totalResult is asserted, confirming that the ListUsers gRPC handlers in both v2 and v2beta were the entry points for this vulnerability.
github.com/zitadel/zitadel/internal/query.(*Queries).SearchUsersinternal/query/user.go
github.com/zitadel/zitadel/internal/api/grpc/user/v2.(*Server).ListUsersinternal/api/grpc/user/v2/server.go
github.com/zitadel/zitadel/internal/api/grpc/user/v2beta.(*Server).ListUsersinternal/api/grpc/user/v2beta/server.go