CVE-2026-32130
Authentication Bypass in Zitadel SCIM API Exposes User Data
Publication date: 2026-03-11
Last updated on: 2026-03-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 4.0.0 (inc) to 4.12.2 (exc) |
| zitadel | zitadel | From 2.68.0 (inc) to 3.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the ZITADEL identity management platform's System for Cross-domain Identity Management (SCIM) API versions from 2.68.0 to before 3.4.8 and 4.12.2. The issue arises because requests to the API with URL-encoded path values are routed correctly but bypass necessary authentication and permission checks.
As a result, unauthenticated attackers can retrieve sensitive user information such as names, email addresses, phone numbers, addresses, external IDs, and roles. However, attackers cannot modify or delete any user data due to additional checks.
This vulnerability has been fixed in versions 3.4.8 and 4.12.2.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthenticated attackers to access sensitive personal information of users managed by the ZITADEL platform. Such information includes names, email addresses, phone numbers, addresses, external IDs, and roles.
Although attackers cannot modify or delete user data, the exposure of sensitive information can lead to privacy breaches, identity theft, targeted phishing attacks, and other security risks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Zitadel to version 3.4.8 or 4.12.2 or later, where the issue has been fixed.
Since the vulnerability allows unauthenticated access to sensitive information via the SCIM API with URL-encoded path values, restricting access to the SCIM API endpoints until the upgrade is applied can reduce risk.