Is CVE-2026-76081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76081 being exploited in the wild.

How severe is CVE-2026-76081?

Medium severity, with a CVSS score of 5.5, published 14 September 2026.

Which products and versions are affected?

github.com/zitadel/zitadel (Go) < 4.16.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.16.0; ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions).

Is there a fix for CVE-2026-76081?

Yes. github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76081 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76081?

Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76081: ZITADEL improper role revocation on granted projects

Q: Is there a fix for CVE-2026-76081?

Yes. github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76081 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-76081?

Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76081 · Severity: medium · CVSS 5.5 · Published 2026-09-14

ZITADEL is an identity and access management platform used to manage user roles and permissions across organizations. When multiple project roles are deleted simultaneously from shared projects (Project Grants), a logic error can cause some role removals to be skipped, allowing users to retain access privileges that should have been revoked. The impact depends on the sensitivity of skipped roles; administrative or high-privilege roles left in place could enable unauthorized access or data exposure within granted projects.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-76081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76081 being exploited in the wild.
How severe is CVE-2026-76081?: Medium severity, with a CVSS score of 5.5, published 14 September 2026.
Which products and versions are affected?: github.com/zitadel/zitadel (Go) < 4.16.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.16.0; ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions).
Is there a fix for CVE-2026-76081?: Yes. github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76081 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76081?: Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later
```
go get github.com/zitadel/zitadel@v4.16.0
```

Technical details

An off-by-one error (CWE-193) in ZITADEL's role-removal logic causes the system to skip certain roles when multiple roles are deleted from a User Grant on a Granted Project (cross-organization shared project). When administrators delete two or more project roles simultaneously, a background process intended to revoke those roles from assigned users iterates through the user's role list incorrectly, potentially skipping over items in the collection. This vulnerability affects only User Grants on Granted Projects; direct project roles and organization-level roles are unaffected. Exploitation requires high-level administrative privileges to initiate the simultaneous multi-role deletion. The fix (version 4.16.0+) corrects the loop logic and includes an automatic database migration to identify and remediate any lingering permissions left by this bug. The 3.x release channel (EOL) will not receive a patch.

Affected products

ZITADEL ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions)

Identifiers

CVE-2026-76081
GHSA-v859-c572-qh5p
GO-2026-6473

Timeline

2026-09-14: disclosed
2026-09-14: patched: Fixed in version 4.16.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.