Vulnerability · Published Nov 7, 2025 · Assigned by GitHub_M
CVE-2025-64431IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
High 8.7
In plain English
A high-severity authorization bypass via user-controlled key in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 4.6.3 | GHSA-cpf4-pmr4-w6cx |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 | GHSA-cpf4-pmr4-w6cx |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 | GO-2025-4099 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-cpf4-pmr4-w6cx x_refsource_CONFIRM
- https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed x_refsource_MISC
- https://github.com/zitadel/zitadel/releases/tag/v4.6.3 x_refsource_MISC