Identity Management Platform Vulnerability in ZITADEL by ZITADEL

CVE-2026-76081

What is CVE-2026-76081?

A flaw in the ZITADEL identity management platform can lead to improper permission updates when multiple project roles are deleted simultaneously, potentially allowing unauthorized users to maintain access rights intended for removal. This vulnerability particularly affects 'User Grants' on projects shared among different organizations. Users are recommended to upgrade to version 4.16.0 where this issue has been resolved. For those unable to upgrade, a manual review of user permissions should be performed on any Granted Projects where roles were recently deleted to ensure compliance.

References