CVE-2026-55670: ZITADEL Auth Bypass Vulnerability

CVE-2026-55670 Overview

CVE-2026-55670 is an access control weakness [CWE-284] in ZITADEL, an open source identity and access management platform. The event store validation logic retains the original resource owner for a deleted user identifier. When an administrator later recreates a user with the same identifier under a different organization, ZITADEL provisions that user under the original organization. The recreated account is then exposed to the administrator of the prior organization instead of the intended tenant. The issue affects ZITADEL versions prior to 4.15.1 and is resolved in version 4.15.2.

Critical Impact
Cross-tenant identity leakage — user accounts recreated with a reused identifier can be provisioned under an unintended organization, granting the prior organization's administrator visibility into the new account.

Affected Products

ZITADEL identity management platform
Versions prior to 4.15.1
Fixed in version 4.15.2

Discovery Timeline

2026-07-10 - CVE-2026-55670 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55670

Vulnerability Analysis

ZITADEL uses an event-sourced architecture where every state change is persisted as an immutable event in an event store. Each event carries a resource_owner field that binds the event to a specific organization (tenant). The vulnerability arises because the event store validation layer preserved the original resource_owner associated with a previously deleted user identifier. When a new user is created reusing that identifier in a different organization, the historical binding survives validation and is applied to the recreated account.

The result is a business logic and access control failure spanning tenant boundaries. The recreated user is silently attached to the original organization, and that organization's administrator gains visibility over the account. This breaks the multi-tenant isolation guarantees that identity platforms are expected to enforce.

Root Cause

The root cause is improper handling of the resource_owner attribute across the lifecycle of a user aggregate in the event store. Deleting a user did not invalidate or reset the resource-owner binding tied to that identifier, so subsequent recreation inherited the stale organization context.

Attack Vector

Exploitation requires the attacker to be a low-privileged authenticated user in a ZITADEL deployment and to know or predict a user identifier that previously existed under a different organization. The attack is network-reachable but has high attack complexity and requires specific preconditions, making opportunistic exploitation unlikely.

text

-- Patch excerpt from cmd/setup/40/01_type.sql
-- fix(eventstore): allow overwriting resource owner of events (#12261)

 DO $$ BEGIN
-    CREATE TYPE eventstore.command AS (
+    CREATE TYPE eventstore.command2 AS (
         instance_id TEXT
         , aggregate_type TEXT
         , aggregate_id TEXT

Source: GitHub Commit a939b847

// Patch excerpt from cmd/setup/64.go
func (mig *ChangePushPosition) Execute(ctx context.Context, _ eventstore.Event) error {
-	inTxOrderType, err := mig.inTxOrderType(ctx)
+	inTxOrderType, err := inTxOrderType(ctx, mig.dbClient)
	if err != nil {
		return err
	}

Source: GitHub Commit a939b847. The patch introduces a new eventstore.command2 type and reworks the push-position migration so that the event store can correctly overwrite the resource owner of events.

Detection Methods for CVE-2026-55670

Indicators of Compromise

User accounts appearing in an organization's administrative console without a corresponding provisioning action initiated by that organization.
Audit-log entries showing a newly created user whose resource_owner does not match the organization that issued the create request.
Reuse of a user login name, email, or external identifier that was previously deleted in another organization within the same ZITADEL instance.

Detection Strategies

Query the ZITADEL event store for user.added events and compare each event's resource_owner against the organization context of the initiating API call.
Correlate user.removed events with subsequent user.added events sharing the same identifier to flag identifier reuse across organizations.
Review administrator activity across tenants for unexpected access to accounts that were provisioned by a different organization.

Monitoring Recommendations

Enable and centrally forward ZITADEL admin and audit logs to a SIEM for cross-tenant correlation.
Alert on any create-user operation whose response payload references an organization ID that differs from the caller's organization context.
Track the ZITADEL version deployed in each environment to confirm systems are running 4.15.2 or later.

How to Mitigate CVE-2026-55670

Immediate Actions Required

Upgrade all ZITADEL instances to version 4.15.2, which contains the fix for the event store resource-owner handling.
Audit user accounts created after any deletion event to confirm they belong to the intended organization.
Rotate credentials and re-provision any accounts identified as mis-associated with the wrong organization.

Patch Information

The fix is delivered in ZITADEL Release v4.15.2 via Pull Request #12261 and commit a939b847. Full details are documented in GitHub Security Advisory GHSA-6x8v-2fq5-2229.

Workarounds

Avoid reusing user identifiers, login names, or external IDs across organizations within the same ZITADEL instance until the upgrade is applied.
Restrict administrative operations that recreate users with previously used identifiers to a controlled change-management workflow.
Manually verify the resource_owner of newly created users when identifier reuse cannot be avoided.

bash

# Verify the running ZITADEL version and upgrade to the patched release
zitadel --version

# Docker deployments: pull and redeploy the fixed image
docker pull ghcr.io/zitadel/zitadel:v4.15.2
docker compose up -d zitadel