https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:40:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335757 EUVD-2026-335757 https://cve.radiocsirt.org/vuln/euvd-2026-335757 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55670 <p>ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL&#39;s event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization&#39;s administrator. This issue is fixed in version 4.15.2.</p> <p>ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL&#39;s event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization&#39;s administrator. This issue is fixed in version 4.15.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55670 https://cve.radiocsirt.org/vuln/ghsa-6x8v-2fq5-2229 <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous ID would be used to recreate it.</p> <p>### Impact</p> <p>When a user is created, the system maps the generated or provided ID to its target organization (`Org A`). When that user is subsequently deleted, a deletion event is appended to the stream, but the historical mapping of the resource owner within the event store&#39;s validation layer is not cleared.</p> <p>If a new user is later provisioned in a different organization (`Org B`) using that exact same ID, the event store validation logic reads the stream&#39;s history, matches it to the original organization, and routes the new user&#39;s events to `Org A` instead of `Org B`.</p> <p>This issue represents a localized multi-tenancy isolation anomaly rather than an easily exploitable attack vector. Because the new user instance is incorrectly routed and provisioned inside `Org A` instead of `Org B`, an administrator from `Org A` inadvertently gains full access to this new user record.</p> <p>However, there is no technical mechanism for a malicious actor to force, automate, or target this behavior against a specific user or tenant. Because the scenario relies entirely on an accidental sequence of operational events and requires the recycling of a highly specific ID spa…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous ID would be used to recreate it.</p> <p>### Impact</p> <p>When a user is created, the system maps the generated or provided ID to its target organization (`Org A`). When that user is subsequently deleted, a deletion event is appended to the stream, but the historical mapping of the resource owner within the event store&#39;s validation layer is not cleared.</p> <p>If a new user is later provisioned in a different organization (`Org B`) using that exact same ID, the event store validation logic reads the stream&#39;s history, matches it to the original organization, and routes the new user&#39;s events to `Org A` instead of `Org B`.</p> <p>This issue represents a localized multi-tenancy isolation anomaly rather than an easily exploitable attack vector. Because the new user instance is incorrectly routed and provisioned inside `Org A` instead of `Org B`, an administrator from `Org A` inadvertently gains full access to this new user record.</p> <p>However, there is no technical mechanism for a malicious actor to force, automate, or target this behavior against a specific user or tenant. Because the scenario relies entirely on an accidental sequence of operational events and requires the recycling of a highly specific ID spa…</p> https://cve.radiocsirt.org/vuln/ghsa-6x8v-2fq5-2229