# CVE-2026-55670: ZITADEL cross-tenant user leakage via recycled identifiers in event store

Source: https://junglewise.ai/threats/cve-2026-55670-zitadel-cross-tenant-user-leakage-via-recycled-identifiers-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55670 · Severity: medium · CVSS 4 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage users and access across different organizations. A flaw in how the system handles deleted users could cause a new user, created in one organization, to be accidentally placed under the control of a different organization if they share the same internal identifier. This could allow an unauthorized administrator from the original organization to view or manage a user that does not belong to them.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-55670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55670 being exploited in the wild.

**How severe is CVE-2026-55670?** Medium severity, with a CVSS score of 4, published 10 July 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260615092437-6082e59d47c1, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260615092437-6082e59d47c1; ZITADEL >= 3.0.0, < 4.15.2, 3.0.0 - 3.4.11, 4.0.0 - 4.15.1.

**Is there a fix for CVE-2026-55670?** Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615092437-6082e59d47c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55670 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55670?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615092437-6082e59d47c1 or later

  ```sh
  go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615092437-6082e59d47c1
  ```


## Technical details

An authorization bypass exists in ZITADEL's event store validation layer due to improper handling of resource owner history. When a user is deleted, the historical mapping of the resource owner is not cleared; if a new user is subsequently created in a different organization (Org B) using the same identifier as a previously deleted user from Org A, the system incorrectly routes the new user's events to Org A. This results in cross-tenant leakage where Org A's administrator gains access to the new user record. The vulnerability requires the reuse of specific identifiers and is fixed in version 4.15.2 by introducing explicit owner enforcement in the event store commands.

## Affected products

- ZITADEL ZITADEL >= 3.0.0, < 4.15.2

## Identifiers

- CVE-2026-55670
- GHSA-6x8v-2fq5-2229
- GO-2026-5197

## Timeline

- 2026-06-15: patched: Fix committed to repository
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46](https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46)
- [https://github.com/zitadel/zitadel/pull/12261](https://github.com/zitadel/zitadel/pull/12261)
- [https://github.com/zitadel/zitadel/releases/tag/v4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)
- [https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229](https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)