# CVE-2026-76081: ZITADEL improper role revocation on granted projects

Source: https://junglewise.ai/threats/cve-2026-76081-zitadel-improper-role-revocation-on-granted-projects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76081 · Severity: medium · CVSS 5.5 · Published 2026-09-14

ZITADEL is an identity and access management platform used to manage user roles and permissions across organizations. When multiple project roles are deleted simultaneously from shared projects (Project Grants), a logic error can cause some role removals to be skipped, allowing users to retain access privileges that should have been revoked. The impact depends on the sensitivity of skipped roles; administrative or high-privilege roles left in place could enable unauthorized access or data exposure within granted projects.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-76081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76081 being exploited in the wild.

**How severe is CVE-2026-76081?** Medium severity, with a CVSS score of 5.5, published 14 September 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) < 4.16.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.16.0; ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions).

**Is there a fix for CVE-2026-76081?** Yes. github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76081 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-76081?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 4.16.0 or later

  ```sh
  go get github.com/zitadel/zitadel@v4.16.0
  ```


## Technical details

An off-by-one error (CWE-193) in ZITADEL's role-removal logic causes the system to skip certain roles when multiple roles are deleted from a User Grant on a Granted Project (cross-organization shared project). When administrators delete two or more project roles simultaneously, a background process intended to revoke those roles from assigned users iterates through the user's role list incorrectly, potentially skipping over items in the collection. This vulnerability affects only User Grants on Granted Projects; direct project roles and organization-level roles are unaffected. Exploitation requires high-level administrative privileges to initiate the simultaneous multi-role deletion. The fix (version 4.16.0+) corrects the loop logic and includes an automatic database migration to identify and remediate any lingering permissions left by this bug. The 3.x release channel (EOL) will not receive a patch.

## Affected products

- ZITADEL ZITADEL 4.0.0 through 4.15.3; 3.0.0 through 3.4.12 (including RC versions)

## Identifiers

- CVE-2026-76081
- GHSA-v859-c572-qh5p
- GO-2026-6473

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.16.0

## References

- [https://api.github.com/users/AyushParkara](https://api.github.com/users/AyushParkara)
- [https://github.com/AyushParkara](https://github.com/AyushParkara)
- [https://api.github.com/users/AyushParkara/gists%7B/gist_id%7D](https://api.github.com/users/AyushParkara/gists%7B/gist_id%7D)
- [https://api.github.com/users/AyushParkara/repos](https://api.github.com/users/AyushParkara/repos)
- [https://avatars.githubusercontent.com/u/100233436?v=4](https://avatars.githubusercontent.com/u/100233436?v=4)
- [https://api.github.com/users/AyushParkara/events%7B/privacy%7D](https://api.github.com/users/AyushParkara/events%7B/privacy%7D)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)