{"id":"CVE-2024-32967","aliases":["EUVD-2024-1736","GHSA-q5qj-x2h5-3945","GO-2024-2804"],"status":"published","title":"Zitadel exposes internal database user name and host information","description":"Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00635,"percentile":0.50867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-05-01T06:43:36Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Go","package":"github.com/zitadel/zitadel","fixed_in":["2.50.3","2.49.5","2.48.5","2.47.10","2.45.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.50.0"},{"fixed":"2.50.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.49.0"},{"fixed":"2.49.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.48.0"},{"fixed":"2.48.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.47.0"},{"fixed":"2.47.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.50.0"},{"fixed":"2.50.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.49.0"},{"fixed":"2.49.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.48.0"},{"fixed":"2.48.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"2.47.0"},{"fixed":"2.47.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.45.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/zitadel/zitadel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"zitadel","product":"zitadel"}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.45.7","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.46.7","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.47.10","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.48.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.49.5","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/zitadel/zitadel/releases/tag/v2.50.3","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32967","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q5qj-x2h5-3945"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32967.json","tags":["advisory"]},{"url":"https://github.com/zitadel/zitadel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-32967","title":"Zitadel exposes internal database user name and host information","description":"Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.","status":"published","published":"2024-05-01T06:43:36.137Z","modified":"2024-08-02T02:27:53.191Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-1736","description":"Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.","status":"published","published":"2024-05-01T06:43:36Z","modified":"2024-08-02T02:27:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:22.469918Z"}],"ghsa":[{"id":"GHSA-q5qj-x2h5-3945","title":"Zitadel exposing internal database user name and host information","description":"### Impact\n\nIn case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3)\n2.49.x versions are fixed on \u003e= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5)\n2.48.x versions are fixed on \u003e= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5)\n2.47.x versions are fixed on \u003e= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10)\n2.46.x versions are fixed on \u003e= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7)\n2.45.x versions are fixed on \u003e= [2.45.7](https://github.com/zitadel/zitadel/releases/tag/v2.45.7)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)","status":"published","published":"2024-05-01T16:36:04Z","modified":"2024-08-07T05:01:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2024-32967","description":"Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.","status":"published","published":"2024-05-01T07:15:40.537Z","modified":"2026-06-17T07:30:47.36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:09:55.124919Z"}],"osv":[{"id":"CVE-2024-32967","title":"Zitadel exposes internal database user name and host information","description":"Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.","status":"published","published":"2024-05-01T06:43:36.137Z","modified":"2026-10-28T02:30:58.940005048Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-q5qj-x2h5-3945","title":"Zitadel exposing internal database user name and host information","description":"### Impact\n\nIn case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.\n\n### Patches\n\n2.x versions are fixed on \u003e= [2.50.3](https://github.com/zitadel/zitadel/releases/tag/v2.50.3)\n2.49.x versions are fixed on \u003e= [2.49.5](https://github.com/zitadel/zitadel/releases/tag/v2.49.5)\n2.48.x versions are fixed on \u003e= [2.48.5](https://github.com/zitadel/zitadel/releases/tag/v2.48.5)\n2.47.x versions are fixed on \u003e= [2.47.10](https://github.com/zitadel/zitadel/releases/tag/v2.47.10)\n2.46.x versions are fixed on \u003e= [2.46.7](https://github.com/zitadel/zitadel/releases/tag/v2.46.7)\n2.45.x versions are fixed on \u003e= [2.45.7](https://github.com/zitadel/zitadel/releases/tag/v2.45.7)\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)","status":"published","published":"2024-05-01T16:36:04Z","modified":"2026-09-10T03:49:18.740696002Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GO-2024-2804","title":"Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel","description":"Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v2.45.7, from v2.47.0 before v2.47.10, from v2.48.0 before v2.48.5, from v2.49.0 before v2.49.5, from v2.50.0 before v2.50.3.","status":"published","published":"2024-06-05T15:10:42Z","modified":"2024-07-09T19:33:56Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}