Listen to this Post
How the mentioned CVE works:
The vulnerability exists within Zitadel’s User Service API. When an authenticated user, regardless of their specific permissions, queries the user list endpoint, the service incorrectly calculates and returns a `totalResult` field. This field contains the total count of all users within the instance. The underlying flaw is a missing or incorrect authorization check in the user counting logic. The system fails to filter the count based on the querying user’s actual “read” permissions before executing the count operation. Consequently, even a low-privilege user who can only see a subset of users in the list view receives the accurate total number of all instance users in the response metadata. This information disclosure occurs through a normal API response rather than an error message. The patch corrects this by binding the count query to the same permission checks used for the data retrieval, ensuring the `totalResult` value only reflects the number of users the requester is authorized to see.
DailyCVE Form:
Platform: Zitadel IAM Platform
Version: 2.44.0 – 4.7.1
Vulnerability : Information Disclosure
Severity: Low
Date: 2025-12-11
Prediction: 2024-06-15 (estimated)
What Undercode Say:
Analytics
Query to replicate the flaw before patch
curl -H "Authorization: Bearer <USER_TOKEN>" "https://<ZITADEL_INSTANCE>/api/v2/users?limit=1"
Analyzing the response for the totalResult field
grep -o '"totalResult":[0-9]' response.json
Example vulnerable response snippet
{
"result": [...],
"totalResult": 12543 This is the exposed total user count
}
How Exploit
1. Attacker obtains a standard user account.
2. Attacker calls the List Users API endpoint.
- Attacker extracts the `totalResult` value from the JSON response.
4. The value is recorded for reconnaissance.
Protection from this CVE
- Upgrade to patched versions: >=2.71.20, >=3.4.5, or >=4.7.2.
- Enable the `permissionCheckV2` feature flag.
- Implement API gateway filtering for
totalResult. - Review user audit logs regularly.
Impact
- Unauthorized scale discovery.
- Business intelligence leakage.
- Reconnaissance for attackers.
- Breach of data confidentiality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
