CVE-2026-76081

Received Received - Intake

Permission Escalation in ZITADEL Identity Platform

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76081

Affected Vendors & Products

Vendor	Product	Version / Range
zitaled	zitaled	4.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

ZITADEL is an open-source identity management platform. A bug in versions before 4.16.0 causes incorrect permission updates when multiple project roles are deleted simultaneously. This can leave some user permissions active even after deletion, specifically affecting User Grants on Granted Projects (shared projects between organizations). The issue was fixed in version 4.16.0.

Detection Guidance

Check ZITADEL version to confirm if it is below 4.16.0. Review user permissions on Granted Projects where multiple roles were recently deleted. Manually inspect access rights for users who should no longer have permissions.

Impact Analysis

Users may retain unauthorized access to shared projects if multiple roles were deleted at once. This could lead to data exposure or unintended actions in projects shared across organizations. The vulnerability does not affect standalone projects.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and timely revocation of permissions (e.g., GDPR's data minimization principle or HIPAA's access management rules). Unauthorized access retention risks non-compliance penalties.

Mitigation Strategies

Upgrade ZITADEL to version 4.16.0 or later. If immediate upgrade is not possible, manually review and revoke user permissions on Granted Projects where multiple roles were deleted.

Hi! I’m here to help you understand CVE-2026-76081. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70