Privilege Escalation in ZITADEL Identity Platform

Executive Summary

CVE-2026-55670 is a vulnerability in ZITADEL versions prior to 4.15.2 where the event store retains the original resource owner for a deleted user identifier. If a new user is created in a different organization using the same identifier as the deleted user, the system incorrectly associates the new user with the original organization. This causes the new user to be provisioned under the original organization and exposed to that organization's administrators.

The root cause is that the eventstore's handling of resource owners was implicit and did not allow explicit control per command or event type, leading to unsafe overwrites of aggregate owners when creating events for reusable aggregates.

The vulnerability is classified as a localized multi-tenancy isolation anomaly with low practical security risk due to the high complexity of exploitation and specific operational conditions required.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-tenant user leakage where a new user created with a recycled identifier in a different organization is mistakenly provisioned under the original organization.

As a result, administrators of the original organization gain unintended access to the new user's records, potentially exposing sensitive user information to unauthorized parties.

However, the practical security risk is considered low because exploiting this issue requires a highly specific sequence of events and is not easily targeted.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the event store retaining the original resource owner for a deleted user identifier, causing cross-tenant user leakage when a user is recreated with the same identifier in another organization.

Detection would require inspecting the event store data to identify cases where user identifiers have been reused across organizations but still retain the original resource owner association.

Since the issue is related to internal event store data and owner assignments, there are no specific network commands or standard system commands provided to detect this vulnerability directly.

The recommended approach is to audit user identifiers and their associated organizations in the event store database to find inconsistencies or cross-tenant provisioning.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade ZITADEL to version 4.15.2 or later, where this vulnerability has been fixed.

The fix involves changes to the event store to explicitly enforce resource owner assignment, preventing the retention of original owners for deleted user identifiers.

Until the upgrade can be applied, carefully audit user provisioning workflows to avoid reusing user identifiers across different organizations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in ZITADEL prior to version 4.15.2 allows cross-tenant user leakage via recycled identifiers, where a user recreated with the same identifier in another organization can be provisioned under the original organization and exposed to that organization's administrators.

This issue could potentially impact compliance with data protection regulations such as GDPR or HIPAA because it involves unauthorized access to user data by administrators of a different organization, violating principles of data segregation and access control.

However, the vulnerability is classified as having low practical security risk due to its high attack complexity and specific operational conditions required for exploitation.

The recommended mitigation is to upgrade to version 4.15.2 or later, where the issue is fixed by explicitly enforcing resource owner assignment in the eventstore.

Useful 0 Not Useful 0