PT-2026-24854 · Git+1 · Zitadel

Odgrso · Publicado 2026-03-11 · Atualizado 2026-03-16 · CVE-2026-32131

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.8 ZITADEL versions prior to 4.12.2

Description ZITADEL is an open source identity management platform. A flaw exists in the Management API that allows authenticated users with a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to access management-plane information from other organizations. This is achieved by specifying the project id, grant id, or app id of a different tenant through the API. The API endpoints involved are not explicitly specified.

Recommendations Update to ZITADEL version 3.4.8 or later. Update to ZITADEL version 4.12.2 or later.

Exploit

Correção

Missing Authorization

IDOR

Enumeração de Fraquezas

CWE-862

CWE-639

Identificadores relacionados

CVE-2026-32131

GHSA-WR6R-59XG-4PJ2

Produtos afetados

Zitadel

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32131.json · Exploit
• https://github.com/zitadel/zitadel/releases/tag/v4.12.2 · Nota
• https://github.com/zitadel/zitadel/releases/tag/v3.4.8 · Nota
• https://github.com/zitadel/zitadel/security/advisories/GHSA-wr6r-59xg-4pj2 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031867619037315234 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32131 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32131 · Nota de Segurança
• https://t.me/cveNotify/155522 · Publicação no Telegram