CVE-2025-23208 IdP group membership revocation ignored in zot
Attackers retain revoked group access in zot registry due to append-only group storage, bypassing authorization controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23208?
CVE-2025-23208 is a high-severity missing authorization vulnerability in project-zot zot, published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-269
Which versions are affected by CVE-2025-23208?
3 open source packages ship an affected version, including zotregistry.dev/zot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zotregistry.dev/zot Go | All versions | None |
zotregistry.dev/zot Go | All versions | 2.1.2 |
zotregistry.dev/zot Go | All versions | 2.1.2 |
Products include Zotregistry Zot.
How do I fix CVE-2025-23208?
Upgrade zotregistry.dev/zot to 2.1.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-23208 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-23208 exists.
Other vulnerabilities in project-zot zot
Sources
Also known as GHSA-c9p4-xwr9-rfhx, GO-2025-3409.