Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jOXA0LXh3cjktcmZoeM4ABDhT

Zot IdP group membership revocation ignored

Summary

The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API.

Details

SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case.

PoC

Login with group claims, logout, remove the user from a group from at IdP and log in again, the API still grants access and the new list of groups is appended creating meaningless duplicate entries and no longer mathing the expected groups from the IdP. The behavior can be verified by seeing the API or UI still presenting images it should not or by viewing the data directly: bbolt get meta.db UserData <user>, eg:

image

Note this example also has duplicates due to group hierarchy changes that were left in the database.

Impact

Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP.

Permalink: https://github.com/advisories/GHSA-c9p4-xwr9-rfhx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jOXA0LXh3cjktcmZoeM4ABDhT
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 days ago
Updated: 8 days ago


CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Percentage: 0.00045
EPSS Percentile: 0.17681

Identifiers: GHSA-c9p4-xwr9-rfhx, CVE-2025-23208
References: Repository: https://github.com/project-zot/zot
Blast Radius: 1.0

Affected Packages

go:zotregistry.dev/zot
Dependent packages: 0
Dependent repositories: 0
Downloads:
Affected Version Ranges: <= 2.1.1
Fixed in: 2.1.2
All affected versions: 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.10, 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.4.0, 1.4.1, 1.4.2, 1.4.3
All unaffected versions: