CVE-2026-76081

Katalog CVE

CVSS 5.5 · Medium EPSS 0,40%

Kerentanan Off-by-one Error. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

16 September 2026

Status NVD

Deferred

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-193: Off-by-one Error

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59
• https://github.com/zitadel/zitadel/releases/tag/v4.16.0
• https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p