Executive brief
ZITADEL is an identity and access management platform used to manage user roles and permissions across organizations. When multiple project roles are deleted simultaneously from shared projects (Project Grants), a logic error can cause some role removals to be skipped, allowing users to retain access privileges that should have been revoked. The impact depends on the sensitivity of skipped roles; administrative or high-privilege roles left in place could enable unauthorized access or data exposure within granted projects.
Technical details
An off-by-one error (CWE-193) in ZITADEL's role-removal logic causes the system to skip certain roles when multiple roles are deleted from a User Grant on a Granted Project (cross-organization shared project). When administrators delete two or more project roles simultaneously, a background process intended to revoke those roles from assigned users iterates through the user's role list incorrectly, potentially skipping over items in the collection. This vulnerability affects only User Grants on Granted Projects; direct project roles and organization-level roles are unaffected. Exploitation requires high-level administrative privileges to initiate the simultaneous multi-role deletion. The fix (version 4.16.0+) corrects the loop logic and includes an automatic database migration to identify and remediate any lingering permissions left by this bug. The 3.x release channel (EOL) will not receive a patch.
Affected products
- ZITADEL ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions)
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.16.0