Executive Summary

This vulnerability exists in the ZITADEL identity management platform's System for Cross-domain Identity Management (SCIM) API versions from 2.68.0 to before 3.4.8 and 4.12.2. The issue arises because requests to the API with URL-encoded path values are routed correctly but bypass necessary authentication and permission checks.

As a result, unauthenticated attackers can retrieve sensitive user information such as names, email addresses, phone numbers, addresses, external IDs, and roles. However, attackers cannot modify or delete any user data due to additional checks.

This vulnerability has been fixed in versions 3.4.8 and 4.12.2.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to access sensitive personal information of users managed by the ZITADEL platform. Such information includes names, email addresses, phone numbers, addresses, external IDs, and roles.

Although attackers cannot modify or delete user data, the exposure of sensitive information can lead to privacy breaches, identity theft, targeted phishing attacks, and other security risks.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Zitadel to version 3.4.8 or 4.12.2 or later, where the issue has been fixed.

Since the vulnerability allows unauthenticated access to sensitive information via the SCIM API with URL-encoded path values, restricting access to the SCIM API endpoints until the upgrade is applied can reduce risk.

Useful 0 Not Useful 0