https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-28T18:21:52.629411+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-260388 EUVD-2026-260388 2026-10-28T18:21:52.631410+00:00 EUVD-2026-260388 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64431 fkie_cve-2025-64431 2026-10-28T18:21:52.631440+00:00

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.

 https://cve.radiocsirt.org/vuln/ghsa-cpf4-pmr4-w6cx GHSA-cpf4-pmr4-w6cx — IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering 2026-10-28T18:21:52.631471+00:00

Affected: Go: github.com/zitadel/zitadel

### Summary

ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.

### Impact

ZITADEL's Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.

This could allow an attacker to:

- **Read** organization data, including the name, domains and metadata. - **Manipulate** (modify) the corresponding organization data. - **Delete** the corresponding data, up to and including the entire organization.

Note that this vulnerability is limited to organization-level data (name, domains, metadata). **No other related data (such as users, projects, applications, etc.) is affected.**

### Affected Versions

Systems running one of the following versions are affected: - **v4.x**: `4.0.0-rc.1` through `4.6.2`

### Patches

The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the caller's permission against the target organization.

- v4.x: Upgrade to version [4.6.3](https://github.com/zitadel/zitadel/releases/tag/v4.6.3) or later.

### Workar…