{"action":"Upgrade github.com/zitadel/zitadel/v2 to 2.63.8 or later.","affected":[{"fixed":"2.63.8","introduced":"0"},{"fixed":"2.64.5","introduced":"2.64.0"},{"fixed":"2.65.6","introduced":"2.65.0"},{"fixed":"2.66.11","introduced":"2.66.0"},{"fixed":"2.67.8","introduced":"2.67.0"},{"fixed":"2.68.4","introduced":"2.68.0"},{"fixed":"2.69.4","introduced":"2.69.0"},{"fixed":"2.70.1","introduced":"2.70.0"}],"component":"github.com/zitadel/zitadel/v2","cve_ids":["CVE-2025-27507"],"ecosystem":"Go","epss":0.00609,"exploited":false,"fixed_versions":["2.63.8","2.64.5","2.65.6","2.66.11","2.67.8","2.68.4","2.69.4","2.70.1"],"ghsa_id":"GHSA-f3gh-529w-v32x","id":"tcs_01M5KF87B48ZB1MGMEPS9W52E1","modified_at":"2025-03-11T17:18:47Z","published_at":"2025-03-04T16:43:56Z","references":["https://osv.dev/vulnerability/GHSA-f3gh-529w-v32x","https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x","https://nvd.nist.gov/vuln/detail/CVE-2025-27507","https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v2.63.8","https://github.com/zitadel/zitadel/releases/tag/v2.64.5","https://github.com/zitadel/zitadel/releases/tag/v2.65.6","https://github.com/zitadel/zitadel/releases/tag/v2.66.11","https://github.com/zitadel/zitadel/releases/tag/v2.67.8","https://github.com/zitadel/zitadel/releases/tag/v2.68.4","https://github.com/zitadel/zitadel/releases/tag/v2.69.4","https://github.com/zitadel/zitadel/releases/tag/v2.70.1","https://github.com/zitadel/zitadel/releases/tag/v2.71.0","https://pkg.go.dev/vuln/GO-2025-3499"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-f3gh-529w-v32x","url":"https://osv.dev/vulnerability/GHSA-f3gh-529w-v32x"}],"summary":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations"}