ZITADEL EUVD-2026-92099

Requires a valid authenticated account that holds the org-scoped user.read permission within any organization on the ZITADEL instance (PR:L); no user interaction is needed. Exploitation is only meaningful on multi-organization/multi-tenant deployments where cross-org isolation matters, and the attacker must know or enumerate target user IDs belonging to other organizations. Affected versions are ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3. Impact is strictly limited to disclosure of which authentication method types foreign-org users have registered - no credentials, tokens, or account modification are exposed.

This is a medium-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, 5.3) correctly reflects a network-reachable, low-complexity flaw that nevertheless requires an authenticated caller (PR:L) and yields only low confidentiality impact with no integrity or availability effect. The CWE-863 (incorrect authorization) classification matches the description: the User Service API checks the user.read scope against the caller's own organization instead of the organization that owns the target user, enabling cross-organization enumeration. No EPSS score, CISA KEV entry, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is moderate-to-low: the flaw leaks only which authentication method types (e.g., TOTP, passkey, password) users in other tenants have registered - useful for reconnaissance and targeted phishing/MFA-fatigue planning, but not direct account compromise. The main caveat is that the single-tenant vs. multi-tenant exposure matters greatly: in shared/multi-org ZITADEL instances this is a genuine cross-tenant data-isolation break, whereas in single-tenant deployments the practical impact is negligible.

An authenticated member of Organization A who legitimately holds the org-scoped user.read permission issues GET /v2/users/{userId}/authentication_methods against user IDs belonging to Organization B. Because the API authorizes against the caller's org rather than the target user's org, it returns the registered authentication method types for those foreign-tenant users, letting the attacker map MFA posture across organizations to prime targeted phishing or MFA-fatigue attacks. No public exploit code was identified at time of analysis, and exploitation requires only valid credentials plus knowledge or guessing of target user IDs.