Zitadel up to 3.4.14/4.17.0 Enrollment x-zitadel-orgid improper authorization

Summaryinfo

A vulnerability has been found in Zitadel up to 3.4.14/4.17.0 and classified as critical. This affects an unknown part of the component Enrollment. This manipulation of the argument x-zitadel-orgid causes improper authorization. This vulnerability is tracked as CVE-2026-105209. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Zitadel up to 3.4.14/4.17.0 and classified as critical. Affected by this vulnerability is an unknown part of the component Enrollment. The manipulation of the argument x-zitadel-orgid with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-105209 since 10/04/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 3.4.15 or 4.17.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-92102). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Zitadel

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12
• 3.4.13
• 3.4.14
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17.0

Website

• Product: https://github.com/zitadel/zitadel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion