PT-2026-24854 · Git+1 · Zitadel

Odgrso · Published 2026-03-11 · Updated 2026-03-16 · CVE-2026-32131

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.8 ZITADEL versions prior to 4.12.2

Description ZITADEL is an open source identity management platform. A flaw exists in the Management API that allows authenticated users with a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to access management-plane information from other organizations. This is achieved by specifying the project id, grant id, or app id of a different tenant through the API. The API endpoints involved are not explicitly specified.

Recommendations Update to ZITADEL version 3.4.8 or later. Update to ZITADEL version 4.12.2 or later.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-32131

GHSA-WR6R-59XG-4PJ2

Affected Products

Zitadel

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32131.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-wr6r-59xg-4pj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32131 · Security Note
• https://github.com/zitadel/zitadel/releases/tag/v4.12.2 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.8 · Note
• https://twitter.com/CVEnew/status/2031867619037315234 · Twitter Post
• https://t.me/cveNotify/155522 · Telegram Post