Authentication Bypass in ZITADEL Identity Management Platform

CVE-2026-32130

What is CVE-2026-32130?

CVE-2026-32130 is a vulnerability found within the ZITADEL Identity Management Platform, an open-source solution designed for managing user identities and permissions across various systems. This specific flaw pertains to the System for Cross-domain Identity Management (SCIM) API, which allows for the provisioning of users from external providers into ZITADEL. The vulnerability exists in versions 2.68.0 to prior to 3.4.8 and 4.12.2, where authentication and permission checks are bypassed for requests made to the SCIM API using URL-encoded path values. As a result, unauthorized attackers can access sensitive user information, including names, email addresses, phone numbers, addresses, external IDs, and roles. However, the vulnerability does not allow attackers to manipulate or delete user data due to additional checks in place for these operations. This exposure can lead to severe privacy violations, reputational damage, and regulatory repercussions for organizations utilizing ZITADEL.

Potential impact of CVE-2026-32130

1. Data Exposure: The ability for unauthorized users to retrieve sensitive information can lead to significant privacy breaches. This information can be exploited for identity theft or targeted phishing attacks against users.

2. Regulatory Compliance Risks: Organizations storing personal data must adhere to various data protection regulations, such as GDPR or CCPA. The unauthorized access of user data via this vulnerability may result in non-compliance and associated penalties.

3. Reputational Damage: Data breaches can severely impact an organization’s reputation, leading to a loss of customer trust and potentially resulting in decreased user engagement or financial losses. Organizations may also face scrutiny from stakeholders and a backlash from the public should user data be compromised.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch →

References