CVE-2026-109374

Katalog CVE

CVSS 5.5 · Medium EPSS 0,21%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 5.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.

Rincian

Terbit di NVD

12 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/security/advisories/GHSA-w4gv-rcwj-w6r5
• https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-privilege-escalation-via-oidc-token-exchange-...