CVE-2025-23208
CVSS 3.1 Score 7.3 of 10 (high)
Details
Published Jan 17, 2025
CWE ID 269
Summary
CVE-2025-23208 is a vulnerability affecting the Zot OCI image registry. The issue stems from the way group data is handled in the boltdb database (meta.db). Instead of replacing group memberships upon login, new ones are appended. As a result, group revocations and removals are ignored in the API, potentially compromising Zot's group-based authorization. The vulnerability has been resolved in version 2.1.2, and all users are advised to upgrade as soon as possible. No known workarounds are available for this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Zot