Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD5.3 Medium

CVE-2026-105206

ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zitadel zitadel

Default version status: unaffected

  • 4.0.0 to < 4.17.3affected
  • 4.17.3unaffected

zitadel zitadel

Default version status: unaffected

  • 3.0.0 to ≤ 3.4.15affected

References