CVE-2024-49757

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
zitadel	zitadel	>= 2.63, < 2.63.5; >= 2.62, < 2.62.7; >= 2.61, < 2.61.3; >= 2.60, < 2.60.3; >= 2.59, < 2.59.4; < 2.58.6

References

https://github.com/zitadel/zitadel/releases/tag/v2.58.7Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.59.5Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.60.4Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.61.4Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.62.7Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.63.5Release Notes
https://github.com/zitadel/zitadel/releases/tag/v2.64.0Release Notes
https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjcPatch, Vendor Advisory

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-497584.8LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application CVE-2024-497595.4LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage CVE-2024-49765.5Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.CVE-2024-497605.3OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it const CVE-2024-497617.5REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &#CVE-2024-497624.6Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` re CVE-2024-497638.7PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from CVE-2024-497645.4LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Captur CVE-2024-497659.1Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled co CVE-2024-497665.3Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths li CVE-2024-497677.5Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding t CVE-2024-497684.8Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (default