Executive brief
ZITADEL is an open-source identity management platform used to manage users and access across different organizations. A flaw in how the system handles deleted users could cause a new user, created in one organization, to be accidentally placed under the control of a different organization if they share the same internal identifier. This could allow an unauthorized administrator from the original organization to view or manage a user that does not belong to them.
Technical details
An authorization bypass exists in ZITADEL's event store validation layer due to improper handling of resource owner history. When a user is deleted, the historical mapping of the resource owner is not cleared; if a new user is subsequently created in a different organization (Org B) using the same identifier as a previously deleted user from Org A, the system incorrectly routes the new user's events to Org A. This results in cross-tenant leakage where Org A's administrator gains access to the new user record. The vulnerability requires the reuse of specific identifiers and is fixed in version 4.15.2 by introducing explicit owner enforcement in the event store commands.
Affected products
- ZITADEL ZITADEL >= 3.0.0, < 4.15.2
Timeline
- 2026-06-15: patched: Fix committed to repository
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD