Executive brief
Zot IdP group membership revocation ignored in zotregistry.dev/zot
Affected products
- Go zotregistry.dev/zot
Junglewise Threat Intelligence
CVE-2025-23208: GO-2025-3409 - Zot IdP group membership revocation ignored in zotregistry.dev/zot
CVE-2025-23208 · Severity: low · CVSS 3.1 · Published 2025-01-28
Technologies: zotregistry.dev/zot (Go). Vendors: Go.
Related threats
- GO-2026-4668 - zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) in zotregistry.dev/zot
- GO-2025-3705 - zot logs secrets in zotregistry.dev/zot
- GO-2024-2979 - Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot