ZITADEL CVE-2025-67717

Exploitation requires a valid authenticated session (any user, regardless of granted read permissions) on a ZITADEL instance running an affected version (2.44.0-2.71.19, 3.0.0-rc.1-3.4.4, or 4.0.0-rc.1-4.7.1); the attacker invokes the User Service ListUsers query and reads the totalResult field. The flaw is present in the default configuration - the specific limiting/mitigating factor is the permissionCheckV2 feature, which when ENABLED acts as a workaround that correctly scopes totalResult to only users the caller can read, so instances with permissionCheckV2 active are not exposed. Exploitation is otherwise limited only by the need for authentication and yields aggregate count data, not individual user records or PII.

This is a genuinely low-priority, low-real-risk issue despite a MEDIUM 5.3 CVSS, and the signals are mutually consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the single low confidentiality impact (VC:L, VI:N, VA:N, no scope change) correctly describe a minor information-disclosure flaw: a network-reachable but AUTHENTICATED (PR:L) request that leaks only an aggregate count, not individual records or PII. EPSS reinforces this - 0.22% probability at the 12th percentile indicates exploitation is very unlikely to be attempted at scale. There is no CISA KEV listing and no public exploit code, so the honest status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. One nuance to verify with the vendor: the NVD description states the count is disclosed 'to authenticated users,' while the GHSA advisory summary line says 'unauthorized users' before its own body clarifies 'any authenticated user, regardless of their specific permissions' - the authoritative reading, consistent with PR:L, is that a valid but under-privileged authenticated session is required. The real risk is confined to the fact that an authenticated low-permission principal can learn the total user count of an instance, which is reconnaissance value only.

An authenticated but low-privileged user (or a tenant member who should not see instance-wide data) calls the ZITADEL User Service ListUsers endpoint and reads the totalResult field in the response, learning the total number of users provisioned in the instance even though they lack read permission over those users. No public proof-of-concept exists; because the vector is network-reachable with low complexity and no user interaction, any valid session token is sufficient to reproduce it against a default configuration.