Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
ZITADEL: Unauthorized Access to Sensitive Data in Management API
CVE-2026-32131
Summary
A security issue in ZITADEL's Management API allowed users with limited permissions to access sensitive information from other organizations. This has been fixed in versions 3.4.8 and 4.12.2. We recommend updating to these versions to ensure security.
Original title
ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed authenticated users holding a valid l...
Original description
ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed authenticated users holding a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to retrieve management-plane information belonging to other organizations by specifying a different tenant’s project_id, grant_id, or app_id. This vulnerability is fixed in 3.4.8 and 4.12.2.
nvd CVSS3.1
7.7
Vulnerability type
CWE-639
Authorization Bypass Through User-Controlled Key
CWE-862
Missing Authorization
Published: 11 Mar 2026 · Updated: 14 Mar 2026 · First seen: 11 Mar 2026