CVE-2025-67717

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.44.0 through 3.4.4 ZITADEL versions 4.0.0-rc.1 through 4.7.1

Description ZITADEL, an open-source identity infrastructure tool, reveals the total number of instance users to authenticated users, irrespective of their permissions. This information disclosure occurs through the totalResult field. While individual user data or personally identifiable information (PII) is not exposed, disclosing the total user count may be sensitive in certain situations.

Recommendations Update to ZITADEL version 3.4.5 or later. Update to ZITADEL version 4.7.2 or later.