Group-based Authorization Vulnerability in Zot Image Registry

CVE-2025-23208

What is CVE-2025-23208?

Zot, a vendor-neutral OCI image registry, suffers from a vulnerability affecting group-based authorization. The issue arises from how user group data is stored in the boltdb database. Specifically, the stored group list is treated as an append-only structure, leading to failures in properly revoking or removing group memberships via the API when users log in. As a result, group removals by an Identity Provider (IdP) are ignored. This flaw hampers the expected functionality of group configurations, potentially allowing unauthorized access. Users are strongly advised to upgrade to version 2.1.2, as there are no known workarounds for this vulnerability.

References