Upstream information

CVE-2025-27507 at MITRE

Description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores
CVSS detail CNA (GitHub)
Base Score 9
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact Low
CVSSv3 Version 3.1
No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
Container suse/sl-micro/6.0/baremetal-os-container:latest
Container suse/sl-micro/6.0/base-os-container:latest
Container suse/sl-micro/6.0/kvm-os-container:latest
Container suse/sl-micro/6.0/rt-os-container:latest
Container suse/sl-micro/6.0/toolbox:latest
  • libxml2-2 >= 2.11.6-3.1
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
Image SL-Micro
  • libxml2-2 >= 2.11.6-3.1
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-EC2
Image SLE-Micro-GCE
  • libxml2-2 >= 2.11.6-3.1
  • libxml2-tools >= 2.11.6-3.1
  • update-alternatives >= 1.22.0-slfo.1.1_2.1
SUSE Linux Enterprise Server 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20250312T181707-1.1
 Patchnames:
openSUSE-Tumbleweed-2025-14889

SUSE Timeline for this CVE

CVE page created: Tue Mar 4 20:00:45 2025
CVE page last modified: Sat Nov 8 22:35:12 2025