Incorrect Authorization in ZITADEL Allows Unauthorized User Data Access

Executive Summary

CVE-2026-105206 is an incorrect authorization flaw in ZITADEL's User Service API. It allows authenticated users with org-scoped user.read permissions to query authentication methods of users in other organizations by accessing GET /v2/users/{userId}/authentication_methods. The system incorrectly verifies permissions against the caller's organization instead of the target user's organization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for unauthorized queries to GET /v2/users/{userId}/authentication_methods from users outside the target user's organization. Check for repeated requests to this endpoint by org-scoped users with user.read permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to enumerate authentication methods (e.g., passwords, passkeys, TOTP) used by users in other organizations on the same ZITADEL instance. While it does not expose secrets or allow modification, it helps map attack surfaces across organizations by identifying which authentication types are in use.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to authentication method data across organizations. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for sensitive health information. The flaw allows enumeration of authentication methods without proper authorization, which may violate principles of least privilege and data segregation required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ZITADEL to version 4.17.3 or higher immediately. If using ZITADEL 3.x, upgrade to a supported version as no patches will be provided. Restrict user.read permissions to trusted operators only.

Useful 0 Not Useful 0