CVE-2025-64431 - CVE House
Back to Database
Status published High CVE-2025-64431

IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

Vulnerability Description

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64431

Credits & Attribution

No credits recorded in the NVD database.

References

More from zitadel

View All →
CVE-2025-67717
Zitadel Discloses the Total Number of Instance Users
Medium 5.3
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
High 8
CVE-2025-67494
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
Critical 9.3
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
High 7.4
CVE-2025-64103
Zitadel Bypass Second Authentication Factor
High 8.7

Affected Vendor

Affected Software

zitadel
Vulnerable Versions:
>= 4.0.0-rc.1, < 4.6.3, >= 1.80.0-v2.20.0.20250414095945-f365cee73242, < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52

Timeline

Official Publish: November 7th, 2025
Last Modified: November 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-639

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation