CVE-2025-27507 — CVE & Security Advisory Radar

🎯 CVE-2025-27507 CRITICAL 9.0 🔥 EPSS 59% 🧪 PoC 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2025-27507 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authent

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

Klassifikation & Betroffenheit:

zitadel zitadel 2.68.0-rc.1, < 2.68.4zitadel 2.64.0-rc.1, < 2.64.5zitadel 2.65.0-rc.1, < 2.65.6zitadel 2.66.0-rc.1, < 2.66.11zitadel 2.67.0-rc.1, < 2.67.8zitadel 2.69.0-rc.1, < 2.69.4zitadel 2.63.0-rc.1, < 2.63.8zitadel 2.70.0-rc.1, < 2.70.1

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-29191 9.3 CVE-2025-67494 9.3 CVE-2025-64431 8.7 CVE-2025-64103 8.7 CVE-2025-31123 8.7

🩹 Patch verfügbar (OSV):

🩹 754be401a26d176c1ce0608c83bc06798b6a13f9 (Commit) 🩹 7cf7009a3b59c4917ec702720338bbe45d3eaf88 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2025

Veröffentlicht 03/2025

Heute 11.09.

CVSS-Vektor-Analyse: 9.0

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Gering

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Veröffentlicht:04.03.2025

Aktualisiert:17.06.2026 09:03

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2025-7787

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-11
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.0 CRITICAL

🇪🇺 EUVD

EPSS

59%

CVE-2025-27507 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

🧪 zitadel

CVE-2025-27507 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authent

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

04.03.2025

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub