What’s Vulnerable › Vulnerabilities

CVE-2026-105206: ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-29
• Weakness: CWE-863

Description

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.

Affected products

• zitadel: from 4.0.0 before 4.17.3 — fixed in 4.17.3

How to fix

Upgrade to a fixed version: zitadel 4.17.3. Check the vendor advisory for mitigations.

References

• https://github.com/zitadel/zitadel/security/advisories/GHSA-j344-gqv4-84ff
• https://www.vulncheck.com/advisories/zitadel-before-4.17.3-cross-organization-authentication-method-enumeration-via-user-service

Get alerted when CVE-2026-105206 or the next vulnerability affects your stack