Medium severity · published Dec 11, 2025
CVE-2025-67717
Zitadel Discloses the Total Number of Instance Users
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
zitadel · zitadel
< 1.80.0-v2.20.0.20251210; >= 2.44.0, < 3.4.5; >= 4.0.0-rc.1, < 4.7.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67717
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67717
Patch
https://github.com/zitadel/zitadel/commit/826039c6208fe71df57b3a94c982b5ac5b0af12c
Patch
https://github.com/zitadel/zitadel/security/advisories/GHSA-f4cf-9rvr-2rcx
More from zitadel
9.8
CVE-2026-105207
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
9.8
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
9.8
CVE-2025-64103
Zitadel Bypass Second Authentication Factor
9.8
CVE-2025-64102
Zitadel allows brute-forcing authentication factors
9.6
CVE-2026-105209
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment