CVE-2026-55670CWE-284CWE-639

ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers

Low · published July 10, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
28.8
In the wild
Unconfirmed
What it is

ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00362 · 28.8th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-10T17:15Z
EPSS history
Timeline
  • 10 JUL 17:15Z
    ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
    cvelistv5