Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-cpf4-pmr4-w6cx
No affected components available
Summary
ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations.
Impact
ZITADEL's Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.
This could allow an attacker to:
- Read organization data, including the name, domains and metadata.
- Manipulate (modify) the corresponding organization data.
- Delete the corresponding data, up to and including the entire organization.
Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected.
Affected Versions
Systems running one of the following versions are affected:
- v4.x:
4.0.0-rc.1through4.6.2
Patches
The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the caller's permission against the target organization.
- v4.x: Upgrade to version 4.6.3 or later.
Workarounds
Upgrading to a patched version is the recommended solution.
If an immediate upgrade is not possible, mitigation can be achieved by disabling the affected Organization V2Beta API endpoints (e.g., /v2beta/organizations/...) at a reverse proxy or Web Application Firewall (WAF) level.
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard