ZITADEL CVE-2026-109374

Exploitation requires the attacker to already hold an IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role in a ZITADEL instance running 3.0.0 up to (but not including) 4.19.2, and to drive an OIDC token-exchange flow against a relying application; the flaw is that the admin.impersonation check fails to block impersonation of administrator/IAM_OWNER accounts. The principal limiting factor is this privileged delegation prerequisite (PR:H) - only users or service accounts to whom an end-user impersonator role was deliberately granted can trigger it, so arbitrary end users and unauthenticated attackers cannot exploit it; upgrading to 4.19.2 removes the bypass.

This is a genuine but bounded privilege-escalation flaw rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the 5.1 (Medium) base score agree on the central constraint: exploitation requires high pre-existing privilege - specifically a delegated IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role - so this is not a remote-unauthenticated issue despite AV:N. The vendor scored vulnerable-system impact as none (VC:N/VI:N/VA:N) with only subsequent-system confidentiality/integrity as Low (SC:L/SI:L), which is conservative; in practice bypassing the admin.impersonation check to impersonate IAM_OWNER yields effective administrative control over the relying application, which I assess as higher integrity/confidentiality impact than the Low subsequent-system rating implies (noted in confidence_notes). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. Net priority: patch promptly where ZITADEL is used and impersonator roles have been granted, but the PR:H precondition sharply limits the exploitable population, so this ranks below internet-facing unauthenticated RCEs.

An actor who has been granted an end-user impersonator role (IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR) performs an OIDC token exchange against a relying application and, because the admin.impersonation check is bypassed, signs in as an administrator - up to IAM_OWNER - inheriting that account's roles and claims. No public exploit code was identified in the provided data, so exploitation currently depends on manual abuse of the token-exchange flow by someone already holding the impersonator grant.