CVE-2026-55670
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In ZITADEL prior to version 4.15.1, the event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.
Risk Assessment
The risk involves unauthorized access by the original organization's administrator to a user account created in another organization, potentially leading to data confidentiality breaches and broken isolation between organizations.
Recommendation
Immediately upgrade ZITADEL to version 4.15.2 or later to remediate the vulnerability.
Original NVD description (English source)
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.