ZITADEL is an open-source identity infrastructure tool.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Dec 11, 2025 · NIST NVD

   Detected

   ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be

2. Oct 14, 2026 · NIST NVD

   Updated

   ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be

Affected

• cpe zitadel/zitadelversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67717

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67717

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-67717

  ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, d

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com