CVE-2026-55670

Katalog CVE

CVSS 2.3 · Low EPSS 0,36%

Kerentanan Improper Access Control. Skor CVSS 4.0 2.3 (Low) menurut github.com.

Deskripsi (NVD)

ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Deferred

CVSS 4.0

2.3 (Low), sumber github.com
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46
• https://github.com/zitadel/zitadel/pull/12261
• https://github.com/zitadel/zitadel/releases/tag/v4.15.2
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229