PT-2026-24853 · Git+1 · Zitadel

Odgrso · Publicado 2026-03-11 · Atualizado 2026-03-16 · CVE-2026-32130

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.68.0 through 3.4.7 ZITADEL version 4.12.2

Description ZITADEL is an open source identity management platform. Versions 2.68.0 through before 3.4.8 and 4.12.2 contain an issue where requests to the System for Cross-domain Identity Management (SCIM) API with URL-encoded path values bypassed necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information, including names, email addresses, phone numbers, addresses, external IDs, and roles. Data manipulation or deletion was prevented due to additional checks. The API endpoint is susceptible to this issue. The vulnerable parameter is the URL-encoded path value.

Recommendations ZITADEL versions 2.68.0 through 3.4.7 should be updated to version 3.4.8 or later. ZITADEL version 4.12.2 should be used.

Exploit

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-32130

GHSA-83PV-4XXP-RM2X

Produtos afetados

Zitadel

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32130.json · Exploit
• https://github.com/zitadel/zitadel/releases/tag/v4.12.2 · Nota
• https://github.com/zitadel/zitadel/security/advisories/GHSA-83pv-4xxp-rm2x · Aviso do Fabricante
• https://github.com/zitadel/zitadel/releases/tag/v3.4.8 · Nota
• https://twitter.com/CVEnew/status/2031867620106919951 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32130 · Aviso do Fabricante
• https://t.me/cveNotify/155521 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-32130 · Nota de Segurança