https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 18:21:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-260388 EUVD-2026-260388 https://cve.radiocsirt.org/vuln/euvd-2026-260388 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64431 <p>Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.</p> <p>Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64431 https://cve.radiocsirt.org/vuln/ghsa-cpf4-pmr4-w6cx <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>ZITADEL&#39;s Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.</p> <p>### Impact</p> <p>ZITADEL&#39;s Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.</p> <p>This could allow an attacker to:</p> <p>- **Read** organization data, including the name, domains and metadata. - **Manipulate** (modify) the corresponding organization data. - **Delete** the corresponding data, up to and including the entire organization.</p> <p>Note that this vulnerability is limited to organization-level data (name, domains, metadata). **No other related data (such as users, projects, applications, etc.) is affected.**</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **v4.x**: `4.0.0-rc.1` through `4.6.2`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the caller&#39;s permission against the target organization.</p> <p>- v4.x: Upgrade to version [4.6.3](https://github.com/zitadel/zitadel/releases/tag/v4.6.3) or later.</p> <p>### Workar…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>ZITADEL&#39;s Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users with specific **administrator** roles within one organization to access and modify data belonging to **other** organizations.</p> <p>### Impact</p> <p>ZITADEL&#39;s Organization V2Beta API, intended for managing ZITADEL organizations, contains multiple endpoints that fail to properly authorize authenticated users. An attacker with an administrator role for a specific organization could exploit this to bypass access controls and perform unauthorized actions on other organizations within the same ZITADEL instance.</p> <p>This could allow an attacker to:</p> <p>- **Read** organization data, including the name, domains and metadata. - **Manipulate** (modify) the corresponding organization data. - **Delete** the corresponding data, up to and including the entire organization.</p> <p>Note that this vulnerability is limited to organization-level data (name, domains, metadata). **No other related data (such as users, projects, applications, etc.) is affected.**</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **v4.x**: `4.0.0-rc.1` through `4.6.2`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest release. The patch resolves the issue by correctly validating the caller&#39;s permission against the target organization.</p> <p>- v4.x: Upgrade to version [4.6.3](https://github.com/zitadel/zitadel/releases/tag/v4.6.3) or later.</p> <p>### Workar…</p> https://cve.radiocsirt.org/vuln/ghsa-cpf4-pmr4-w6cx