CyberRota Analysis
AI-GeneratedZITADEL, an open-source identity management platform, has a vulnerability that affects user permissions when multiple project roles are deleted simultaneously, potentially allowing users to retain access rights that should have been revoked. This issue impacts User Grants on Granted Projects shared between different organizations and is resolved in version 4.16.0. Organizations using ZITADEL should prioritize upgrading to the latest version or manually reviewing user permissions for affected projects to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.