PT-2026-24853 · Git+1 · Zitadel

Odgrso · Published 2026-03-11 · Updated 2026-03-16 · CVE-2026-32130

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.68.0 through 3.4.7 ZITADEL version 4.12.2

Description ZITADEL is an open source identity management platform. Versions 2.68.0 through before 3.4.8 and 4.12.2 contain an issue where requests to the System for Cross-domain Identity Management (SCIM) API with URL-encoded path values bypassed necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information, including names, email addresses, phone numbers, addresses, external IDs, and roles. Data manipulation or deletion was prevented due to additional checks. The API endpoint is susceptible to this issue. The vulnerable parameter is the URL-encoded path value.

Recommendations ZITADEL versions 2.68.0 through 3.4.7 should be updated to version 3.4.8 or later. ZITADEL version 4.12.2 should be used.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-32130

GHSA-83PV-4XXP-RM2X

Affected Products

Zitadel

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32130.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-83pv-4xxp-rm2x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32130 · Security Note
• https://github.com/zitadel/zitadel/releases/tag/v4.12.2 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.8 · Note
• https://twitter.com/CVEnew/status/2031867620106919951 · Twitter Post
• https://t.me/cveNotify/155521 · Telegram Post