CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

What is CVE-2025-27507?

CVE-2025-27507 is a critical missing authorization vulnerability in zitadel, published on 4 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

Weakness: CWE-639

Which versions are affected by CVE-2025-27507?

33 open source packages ship an affected version, including github.com/zitadel/zitadel and github.com/zitadel/zitadel/v2. It affects 1 product.

Products include Zitadel Zitadel.

How do I fix CVE-2025-27507?

Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 2.63.8, 2.64.5, 2.65.6 or 2.66.11.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-27507 being exploited?

There is no known exploitation of CVE-2025-27507 in the wild and no public exploit code.

Other vulnerabilities in zitadel

• CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint Critical 9.3
• CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login Critical 9.3
• CVE-2025-64103 Zitadel Bypass Second Authentication Factor High 8.7
• CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants High 8.7
• CVE-2024-29891 ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f3gh-529w-v32x, GO-2025-3499.