GHSA-6x8v-2fq5-2229 CVE-2026-55670 GO-2026-5197

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

Low Go

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.36%; Chance of exploitation in the next 30 days. Higher than 30.00% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-284 Improper Access Control; CWE-639 Authorization Bypass Through User-Controlled Key
Fix: 1.80.0-v2.20.0.20260615092437-6082e59d47c1; Upgrade github.com/zitadel/zitadel to this version or later

Description

Summary

A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous ID would be used to recreate it.

Impact

When a user is created, the system maps the generated or provided ID to its target organization (Org A). When that user is subsequently deleted, a deletion event is appended to the stream, but the historical mapping of the resource owner within the event store's validation layer is not cleared.

If a new user is later provisioned in a different organization (Org B) using that exact same ID, the event store validation logic reads the stream's history, matches it to the original organization, and routes the new user's events to Org A instead of Org B.

This issue represents a localized multi-tenancy isolation anomaly rather than an easily exploitable attack vector. Because the new user instance is incorrectly routed and provisioned inside Org A instead of Org B, an administrator from Org A inadvertently gains full access to this new user record.

However, there is no technical mechanism for a malicious actor to force, automate, or target this behavior against a specific user or tenant. Because the scenario relies entirely on an accidental sequence of operational events and requires the recycling of a highly specific ID space, the practical security risk is exceptionally low.

Affected Versions

Systems running one of the following versions are affected:

4.x: 4.0.0 through 4.15.1 (including RC versions)
3.x: 3.0.0 through 3.4.11 (including RC versions)

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.

4.x: Upgrade to $\ge$4.15.2
3.x: Update to $\ge$4.15.2

Workarounds

The recommended solution is to upgrade to a patched version.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to Charlie Graven from Famedly for reporting this vulnerability.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/zitadel/zitadel	`< 1.80.0-v2.20.0.20260615092437-6082e59d47c1`	`1.80.0-v2.20.0.20260615092437-6082e59d47c1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/zitadel/zitadel Go → `1.80.0-v2.20.0.20260615092437-6082e59d47c1`

go

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615092437-6082e59d47c1 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-639: Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

How to prevent it

Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

References

Packages

github.com/zitadel/zitadel

Timeline

Jun 18, 2026 Published
Jul 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-fgmf-7rf8-m6vf ZITADEL: Actions V1 sandbox escape: host file read via require()	High	Also affects github.com/zitadel/zitadel
GHSA-9993-rfwp-rhwf ZITADEL: MFA bypass via session reuse in Login V2	High	Also affects github.com/zitadel/zitadel
GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions	Medium	Also affects github.com/zitadel/zitadel
GHSA-jq8w-8q2f-ffm9 ZITADEL Users Can Self-Verify Email/Phone via API	High	Also affects github.com/zitadel/zitadel
GHSA-vrh8-c9cm-wh8v ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange	High	Also affects github.com/zitadel/zitadel
GHSA-992q-9gwp-7r79 ZITADEL: Auto-linking by email: IdP-side email verification is not checked	Medium	Also affects github.com/zitadel/zitadel
GHSA-v77h-2w3m-94hx ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel
GHSA-g5h5-m4hm-xjrr ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider	Medium	Also affects github.com/zitadel/zitadel

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor