CVE-2025-23208: Zotregistry Zot Auth Bypass Vulnerability

CVE-2025-23208 Overview

CVE-2025-23208 affects Zot, a production-ready vendor-neutral Open Container Initiative (OCI) image registry. The vulnerability resides in how Zot persists user group memberships in its boltdb database (meta.db). Instead of replacing group memberships during login, the SetUserGroups function appends new groups to an existing list. Group revocations issued by an Identity Provider (IdP) are silently ignored by the API. Any Zot deployment relying on group-based authorization continues to grant access to users whose group memberships have been revoked. The issue is fixed in version 2.1.2.

Critical Impact
Group removals or revocations from an Identity Provider are not honored, allowing users to retain access through stale group memberships even after being removed from privileged groups.

Affected Products

Zot OCI image registry versions prior to 2.1.2
Deployments using boltdb backend (meta.db)
Deployments using DynamoDB backend for user metadata

Discovery Timeline

2025-01-17 - CVE-2025-23208 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23208

Vulnerability Analysis

The flaw is an improper privilege management issue [CWE-269] in Zot's user metadata persistence layer. When a user authenticates, Zot calls SetUserGroups to synchronize group memberships from the authenticating IdP. The implementation appends the incoming group list to the previously stored list rather than replacing it. Over successive logins, userData.Groups accumulates every group a user has ever been a member of. Group-based authorization policies evaluate this stale, growing list, so removals never take effect at the API layer. Both the boltdb and DynamoDB storage backends contain the same defect.

Root Cause

The root cause is a single-line append operation in the storage backends. In pkg/meta/boltdb/boltdb.go and pkg/meta/dynamodb/dynamodb.go, the code executed userData.Groups = append(userData.Groups, groups...) instead of assigning the freshly received list. This turns the persisted group set into an append-only log that never contracts.

Attack Vector

An attacker who was previously a member of a privileged group retains that membership after an administrator or IdP revokes it. No authentication bypass or exploit payload is required. The user simply continues to authenticate normally and Zot's authorization checks continue to succeed against the stale group set. Confidentiality is not directly impacted, but integrity of authorization decisions is degraded.

// Source: https://github.com/project-zot/zot/commit/002ac62d8a15bf0cba010b3ba7bde86f9837b613
// Patch in pkg/meta/boltdb/boltdb.go
			return err
		}

-		userData.Groups = append(userData.Groups, groups...)
+		userData.Groups = groups

		err = bdw.setUserData(userid, tx, userData)

// Source: https://github.com/project-zot/zot/commit/002ac62d8a15bf0cba010b3ba7bde86f9837b613
// Patch in pkg/meta/dynamodb/dynamodb.go
		return err
	}

-	userData.Groups = append(userData.Groups, groups...)
+	userData.Groups = groups

	return dwr.SetUserData(ctx, userData)

Detection Methods for CVE-2025-23208

Indicators of Compromise

Entries in meta.db where a user's Groups slice contains duplicate group names or groups the IdP no longer asserts.
Successful Zot API requests from users whose IdP tokens no longer include the group required by policy.
Authorization decisions inconsistent with the current IdP group configuration.

Detection Strategies

Inspect the boltdb meta.db or DynamoDB user metadata table and compare stored Groups values against the current IdP group membership for each user.
Correlate Zot access logs with IdP group-change events to identify users retaining access after revocation.
Audit Zot policy evaluations for actions performed by users who should no longer hold the required group.

Monitoring Recommendations

Alert on Zot API access to repositories governed by group-based policy following an IdP group removal event.
Track deployed Zot versions and flag any instance running a release earlier than 2.1.2.
Log and review changes to user metadata records, especially growth in the Groups field size over time.

How to Mitigate CVE-2025-23208

Immediate Actions Required

Upgrade Zot to version 2.1.2 or later on all registry instances.
After upgrading, reset the stored Groups field for existing users so the next login repopulates it from the IdP.
Review recent access to sensitive repositories by users whose group memberships have changed.

Patch Information

The fix is available in Zot 2.1.2. It replaces the append with a direct assignment so that userData.Groups reflects only the groups asserted by the IdP at login. See the Zot Security Advisory GHSA-c9p4-xwr9-rfhx and the upstream commit 002ac62.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 2.1.2 is required.
As an interim compensating control, manually clear the Groups field in the user metadata store for affected users so subsequent logins rebuild the list.

bash

# Verify Zot version and upgrade to the fixed release
zot --version
# Pull the patched container image
docker pull ghcr.io/project-zot/zot:v2.1.2
# Restart the registry with the updated image
docker compose up -d zot