Description

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T22:16:57.910Z",
  "pubdate": "2026-09-14T22:16:57.910Z",
  "executiveSummary": "ZITADEL versions prior to 4.16.0 contain an authorization logic flaw that leads to inconsistent state synchronization when batch deleting project roles. Specifically, the platform fails to correctly invalidate or revoke User Grants associated with Granted Projects under concurrent role deletion conditions.\nThis vulnerability constitutes an improper authorization state, allowing users to retain persistent access to resources within external organizations even after their administrative permissions have been revoked. The risk implication is significant, as it facilitates unauthorized privilege retention, potentially resulting in data exposure or unauthorized resource manipulation by users who should have been deprovisioned.\nThe vulnerability is inherent to the core permission management system of ZITADEL. There is no configuration-based workaround, as the flaw resides in the backend logic that calculates and enforces effective permissions. Exploitation occurs automatically when the system fails to reconcile the user permission tree during a bulk deletion event, requiring no active attacker intervention to manifest the state inconsistency. Organizations relying on ZITADEL for cross-tenant access control are at risk if they have recently performed bulk deletions of project roles in shared environments. Remediation requires an immediate upgrade to version 4.16.0, which includes a mandatory migration script designed to trigger the necessary cleanup of stale User Grants.",
  "technicalDetails": "The root cause of the vulnerability lies in the internal concurrency and state-management logic responsible for propagating permission changes across the ZITADEL authorization graph. When multiple project roles are deleted simultaneously, the system fails to perform an atomic update of the associated User Grants within the underlying database schema. This race condition or logic error results in a 'residual authorization' state where the mapping between the User Grant and the specific Project Role is not purged, even though the parent role definition has been removed from the platform.\nThe vulnerable component is the permission enforcement engine governing User Grants on Granted Projects—a critical feature for organizations sharing resources across different ZITADEL instances. The flaw specifically manifests during the deletion operation where the application logic fails to properly cascade the deletion signal to all linked user-level permissions. Consequently, while the Role object is deleted, the User Grant record retains a stale reference, causing the authentication middleware to continue evaluating the user as authorized for the project.\nThe attack flow for this vulnerability does not follow a traditional malicious exploit pattern but rather an unintended state persistence: 1) An administrator initiates the bulk deletion of multiple project roles; 2) Due to the flaw, the permission calculation service fails to update the User Grants table synchronously; 3) The backend database maintains stale records that grant the user persistent access; 4) The user, who should be unauthorized, continues to have their identity assertions validated against the project, effectively bypassing intended revocation controls.\nThis issue affects all ZITADEL instances running versions prior to 4.16.0. Authentication is implicitly required to trigger the access, as the user must hold an existing, albeit stale, session to leverage the unauthorized access. The impact is a total failure of the revocation mechanism, meaning that terminated or reassigned users may maintain access to sensitive project data in foreign organizations indefinitely. Post-exploitation, the threat actor operates with the permissions they held prior to the partial deletion. There is no network exposure mechanism for the vulnerability itself, as it is a logical flaw in the internal state management of the identity provider. The resolution in version 4.16.0 corrects the synchronization logic and provides a cleanup migration that effectively iterates through existing User Grants to identify and remove entries linked to non-existent roles, ensuring the integrity of the authorization state."
}