EUVD-2026-42977
GHSA-6x8v-2fq5-2229
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for the improbable ID-recycling preconditions; PR:H because admin privileges are needed to provision users in both tenants; scope changed because impact crosses organizational boundaries.
Primary rating from Vendor (https://github.com/zitadel/zitadel).
CVSS VectorVendor: https://github.com/zitadel/zitadel
Lifecycle Timeline
3DescriptionCVE.org
Summary
A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous ID would be used to recreate it.
Impact
When a user is created, the system maps the generated or provided ID to its target organization (Org A). When that user is subsequently deleted, a deletion event is appended to the stream, but the historical mapping of the resource owner within the event store's validation layer is not cleared.
If a new user is later provisioned in a different organization (Org B) using that exact same ID, the event store validation logic reads the stream's history, matches it to the original organization, and routes the new user's events to Org A instead of Org B.
This issue represents a localized multi-tenancy isolation anomaly rather than an easily exploitable attack vector. Because the new user instance is incorrectly routed and provisioned inside Org A instead of Org B, an administrator from Org A inadvertently gains full access to this new user record.
However, there is no technical mechanism for a malicious actor to force, automate, or target this behavior against a specific user or tenant. Because the scenario relies entirely on an accidental sequence of operational events and requires the recycling of a highly specific ID space, the practical security risk is exceptionally low.
Affected Versions
Systems running one of the following versions are affected:
- 4.x:
4.0.0through4.15.1(including RC versions) - 3.x:
3.0.0through3.4.11(including RC versions)
Patches
The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.
Workarounds
The recommended solution is to upgrade to a patched version.
Questions
If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)
Credits
Thanks to Charlie Graven from Famedly for reporting this vulnerability.
AnalysisAI
Cross-tenant user record leakage in ZITADEL versions 4.0.0-4.15.1 and 3.0.0-3.4.11 allows an organization administrator to inadvertently gain full access to a user record provisioned in a different tenant due to stale aggregate-ID ownership mappings persisting in the event store after user deletion. When a new user is later provisioned in a separate organization using the same ID as a previously deleted user, the event store's owner-resolution logic retrieves the original organization's mapping and incorrectly routes all new provisioning events there. No public exploit has been identified, CISA KEV listing is absent, and the vendor explicitly characterizes this as a non-targetable, low-practical-risk multi-tenancy isolation anomaly that cannot be forced or automated by a malicious actor.
Technical ContextAI
ZITADEL is an open-source identity and access management platform built on an event-sourcing architecture (CPE: pkg:go/github.com/zitadel/zitadel). In event-sourced systems, resource state is derived from a sequential, append-only log of immutable events; each event is associated with an aggregate ID and an owner field representing the organization. The vulnerability (CWE-284: Improper Access Control) resides in the PostgreSQL-backed commands_to_events database function, which resolves ownership by reading the most recent historical owner from the events2 table for a given aggregate ID. When a user is deleted, a deletion event is appended but the resource-owner association for that aggregate ID persists as readable stream history. If the same aggregate ID is subsequently passed to provision a new user in a different organization, the function retrieves the stale historical owner and assigns the new user's events to the original organization rather than the intended one. The patch (commit 6082e59d47c1) introduced an enforce_owner boolean flag to a new command2 composite type and rewrote the function in PL/pgSQL: when enforce_owner is true, the caller-specified owner is used unconditionally and the stale historical mapping is overwritten, preventing cross-tenant routing errors.
RemediationAI
Vendor-released patch: v4.15.2, available at https://github.com/zitadel/zitadel/releases/tag/v4.15.2. For 4.x deployments, upgrade to v4.15.2 or later. The advisory states that 3.x users should also target v4.15.2, which represents a cross-major-version upgrade; administrators running 3.x should consult the advisory at https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229 and verify the supported upgrade path with the vendor before proceeding, as a distinct 3.x patch version may exist but was not referenced in available data. No documented workarounds exist beyond upgrading. As an interim compensating control while scheduling the upgrade, restrict or audit user provisioning workflows to prohibit manual specification of user IDs, ensuring ZITADEL's default auto-generation is always used - this eliminates the ID recycling condition that enables the flaw. Operators can also audit the event store for existing aggregate IDs where the recorded owner does not match the expected organization assignment. Contact security@zitadel.com for guidance specific to your deployment topology.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today