CVE-2025-64431

HIGH

Zitadel 4.0.0-rc.1-4.6.2 - Authenticated Insecure Direct Object Reference via V2Beta API

Title source: llm
STIX 2.1

Description

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.

References (3)

Core 3

Scores

CVSS v4 8.7
EPSS 0.0025
EPSS Percentile 15.7%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-639
Status published
Products (3)
zitadel/zitadel 4.0.0-rc.1 - 4.6.3Go
zitadel/zitadel >= 1.80.0-v2.20.0.20250414095945-f365cee73242, < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52
zitadel/zitadel >= 4.0.0-rc.1, < 4.6.3
Published Nov 07, 2025
Tracked Since Feb 18, 2026