CVE-2025-64431

Description

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.

PUBLISHED Reserved 2025-11-03 | Published 2025-11-07 | Updated 2025-11-07 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

References

github.com/...itadel/security/advisories/GHSA-cpf4-pmr4-w6cx

github.com/...ommit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed

github.com/zitadel/zitadel/releases/tag/v4.6.3

cve.org (CVE-2025-64431)

nvd.nist.gov (CVE-2025-64431)

Download JSON