CVE-2026-55670: ZITADEL cross-tenant user leakage via recycled identifiers in event store

CVE-2026-55670 · Severity: medium · CVSS 4 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage users and access across different organizations. A flaw in how the system handles deleted users could cause a new user, created in one organization, to be accidentally placed under the control of a different organization if they share the same internal identifier. This could allow an unauthorized administrator from the original organization to view or manage a user that does not belong to them.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-55670 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55670 being exploited in the wild.
How severe is CVE-2026-55670?
Medium severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260615092437-6082e59d47c1, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260615092437-6082e59d47c1; ZITADEL >= 3.0.0, < 4.15.2, 3.0.0 - 3.4.11, 4.0.0 - 4.15.1.
Is there a fix for CVE-2026-55670?
Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615092437-6082e59d47c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55670 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55670?
Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615092437-6082e59d47c1 or later
    go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615092437-6082e59d47c1

Technical details

An authorization bypass exists in ZITADEL's event store validation layer due to improper handling of resource owner history. When a user is deleted, the historical mapping of the resource owner is not cleared; if a new user is subsequently created in a different organization (Org B) using the same identifier as a previously deleted user from Org A, the system incorrectly routes the new user's events to Org A. This results in cross-tenant leakage where Org A's administrator gains access to the new user record. The vulnerability requires the reuse of specific identifiers and is fixed in version 4.15.2 by introducing explicit owner enforcement in the event store commands.

Affected products

  • ZITADEL ZITADEL >= 3.0.0, < 4.15.2

Identifiers

  • CVE-2026-55670
  • GHSA-6x8v-2fq5-2229
  • GO-2026-5197

Timeline

  • 2026-06-15: patched: Fix committed to repository
  • 2026-06-17: advisory: GitHub Security Advisory published
  • 2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.