Read the docs
TI-2026-25563 Aliases CVE-2026-33132GHSA-g2pf-ww5m-2r9m

ZITADEL is missing enforcement of organization scopes

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints. This allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Partial zitadel (zitadel): 4.12.3, 3.4.9, 1.80.0-v2.20.0.20260317120401-d90285929ca0github.com/zitadel/zitadel (Go): 4.12.3, 3.4.9, 1.80.0-v2.20.0.20260317120401-d90285929ca0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zitadelzitadel4.0.0-rc.1 to before 4.12.3; 3.0.0-rc.1 to before 3.4.9; before 1.80.0-v2.20.0.20260317120401-d90285929ca04.12.3, 3.4.9, 1.80.0-v2.20.0.20260317120401-d90285929ca0Patch availableCNA
—github.com/zitadel/zitadel (Go)4.0.0-rc.1 to before 4.12.34.12.3Patch availableGHSA-g2pf-ww5m-2r9m
—github.com/zitadel/zitadel (Go)3.0.0-rc.1 to before 3.4.93.4.9Patch availableGHSA-g2pf-ww5m-2r9m
—github.com/zitadel/zitadel (Go)before 1.80.0-v2.20.0.20260317120401-d90285929ca01.80.0-v2.20.0.20260317120401-d90285929ca0Patch availableGHSA-g2pf-ww5m-2r9m
  • zitadel Vendorzitadel Affected 4.0.0-rc.1 to before 4.12.3; 3.0.0-rc.1 to before 3.4.9; before 1.80.0-v2.20.0.20260317120401-d90285929ca0 Fixed in 4.12.3, 3.4.9, 1.80.0-v2.20.0.20260317120401-d90285929ca0 Patch available CNA
  • github.com/zitadel/zitadel (Go) Vendor— Affected 4.0.0-rc.1 to before 4.12.3 Fixed in 4.12.3 Patch available GHSA-g2pf-ww5m-2r9m
  • github.com/zitadel/zitadel (Go) Vendor— Affected 3.0.0-rc.1 to before 3.4.9 Fixed in 3.4.9 Patch available GHSA-g2pf-ww5m-2r9m
  • github.com/zitadel/zitadel (Go) Vendor— Affected before 1.80.0-v2.20.0.20260317120401-d90285929ca0 Fixed in 1.80.0-v2.20.0.20260317120401-d90285929ca0 Patch available GHSA-g2pf-ww5m-2r9m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*before 3.4.9; 4.0.0 to before 4.12.3Vulnerablezitadel
  • cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* Versions before 3.4.9; 4.0.0 to before 4.12.3 Vulnerable ·zitadel

Remediation

  • Fix · CNA zitadel (zitadel) Fixed in 4.12.3, 3.4.9, 1.80.0-v2.20.0.20260317120401-d90285929ca0
  • Fix · GHSA-g2pf-ww5m-2r9m github.com/zitadel/zitadel (Go) Fixed in 4.12.3 Advisory →
  • Fix · GHSA-g2pf-ww5m-2r9m github.com/zitadel/zitadel (Go) Fixed in 3.4.9 Advisory →
  • Fix · GHSA-g2pf-ww5m-2r9m github.com/zitadel/zitadel (Go) Fixed in 1.80.0-v2.20.0.20260317120401-d90285929ca0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33132
  2. 2026-10-03 Alias added: GHSA-g2pf-ww5m-2r9m

References

Patch 2

Advisory 1

Other 3

  • TI-2024-26607 ZITADEL Vulnerable to Session Information Leakage CVSS 3.1MEDIUM 6.5
  • TI-2025-41253 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVSS 3.1CRITICAL 9.3
  • TI-2025-39554 Zitadel Bypass Second Authentication Factor CVSS 4.0HIGH 8.7
  • TI-2024-33224 Zitadel User Registration Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-31388 Service Users Deactivation not Working in Zitadel CVSS 3.1HIGH 8.1
  • TI-2026-23310 ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 CVSS 3.1HIGH 8.2
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences