What is the CVSS score of CVE-2026-32131?

CVE-2026-32131 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zitadel are affected by CVE-2026-32131?

ZITADEL identity management systems running versions 3.4.8 and earlier contain a critical authorization bypass vulnerability that could allow attackers to gain unauthorized access to user accounts…

How to fix or mitigate CVE-2026-32131?

Within 24 hours: Inventory all ZITADEL deployments and document affected versions; enable enhanced logging for authentication events and access attempts. Within 7 days: Implement compensating controls listed below; conduct security assessment of recent access logs for suspicious authentication patterns. Within 30 days: Monitor vendor communications for patch availability; evaluate alternative identity providers if patch timeline extends beyond acceptable risk tolerance; perform full security audit of all user access and permissions granted during vulnerability window.

Zitadel CVE-2026-32131

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-11 security-advisories@github.com

Authentication Bypass Zitadel

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 22:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed authenticated users holding a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to retrieve management-plane information belonging to other organizations by specifying a different tenant’s project_id, grant_id, or app_id. This vulnerability is fixed in 3.4.8 and 4.12.2.

AnalysisAI

ZITADEL is an open source identity management platform. versions up to 3.4.8 is affected by authorization bypass through user-controlled key (CVSS 7.7).

Technical ContextAI

This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects ZITADEL is an open source identity management platform.. ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed authenticated users holding a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to retrieve management-plane information belonging to other organizations by specifying a different tenant’s project_id, grant_id, or app_id. This vulnerability is fixed in 3.4.8 and 4.12.2.