CVE-2026-76081Medium· 5.5▾ SunlitZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/zitadel/zitadel < 4.16.0Patched in:
github.com/zitadel/zitadel 4.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56668High· 8.1ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2023-47111High· 7.3ZITADEL race condition in lockout policy execution
CVE-2023-22492Medium· 5.9Zitadel RefreshToken invalidation vulnerability
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection
CVE-2026-56665Medium· 4.2ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
CVE-2026-56664Medium· 4.2ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider