CVE-2026-33132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33132", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T20:35:49.928Z", "datePublished": "2026-03-20T10:21:19.373Z", "dateUpdated": "2026-03-20T19:31:30.207Z"}, "containers": {"cna": {"title": "ZITADEL is missing enforcement of organization scopes", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m"}, {"name": "https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.9"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v4.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.3"}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"version": ">= 4.0.0-rc.1, < 4.12.3", "status": "affected"}, {"version": ">= 3.0.0-rc.1, < 3.4.9", "status": "affected"}, {"version": "< 1.80.0-v2.20.0.20260317120401-d90285929ca0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T10:21:19.373Z"}, "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints.\nThis allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3."}], "source": {"advisory": "GHSA-g2pf-ww5m-2r9m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T19:30:52.294049Z", "id": "CVE-2026-33132", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T19:31:30.207Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T19:30:52.294049Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T19:31:19.110Z"}}], "cna": {"title": "ZITADEL is missing enforcement of organization scopes", "source": {"advisory": "GHSA-g2pf-ww5m-2r9m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0-rc.1, < 4.12.3"}, {"status": "affected", "version": ">= 3.0.0-rc.1, < 3.4.9"}, {"status": "affected", "version": "< 1.80.0-v2.20.0.20260317120401-d90285929ca0"}]}], "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m", "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8", "name": "https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.9", "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.3", "name": "https://github.com/zitadel/zitadel/releases/tag/v4.12.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints.\nThis allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T10:21:19.373Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33132", "state": "PUBLISHED", "dateUpdated": "2026-03-20T19:31:30.207Z", "dateReserved": "2026-03-17T20:35:49.928Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T10:21:19.373Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zitadel", "vendor": "zitadel", "versions": [{"status": "affected", "version": ">= 4.0.0-rc.1, < 4.12.3"}, {"status": "affected", "version": ">= 3.0.0-rc.1, < 3.4.9"}, {"status": "affected", "version": "< 1.80.0-v2.20.0.20260317120401-d90285929ca0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB64A72E-A1E9-444E-B028-AFDFD32EDEFC", "versionEndExcluding": "3.4.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3282FDC0-7B0C-494E-8F6D-A497EC96E5EE", "versionEndExcluding": "4.12.3", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints.\nThis allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidades de c\u00f3digo abierto. Las versiones anteriores a la 3.4.9 y de la 4.0.0 a la 4.12.2 permit\u00edan a los usuarios eludir la aplicaci\u00f3n de la organizaci\u00f3n durante la autenticaci\u00f3n. Zitadel permite a las aplicaciones aplicar un contexto de organizaci\u00f3n durante la autenticaci\u00f3n utilizando \u00e1mbitos (urn:zitadel:iam:org:id:{id} y urn:zitadel:iam:org:domain:primary:{domainname}). Si se aplica, un usuario necesita ser parte de la organizaci\u00f3n requerida para iniciar sesi\u00f3n. Aunque esto se aplicaba correctamente para las solicitudes de autorizaci\u00f3n de OAuth2/OIDC en el inicio de sesi\u00f3n V1, faltaban controles correspondientes para las solicitudes de autorizaci\u00f3n de dispositivos y todos los puntos finales de inicio de sesi\u00f3n V2 y OIDC API V2. Esto permit\u00eda a los usuarios eludir la restricci\u00f3n e iniciar sesi\u00f3n con usuarios de otras organizaciones. Tenga en cuenta que esta aplicaci\u00f3n permite una verificaci\u00f3n adicional durante la autenticaci\u00f3n y las aplicaciones que dependen de autorizaciones / asignaciones de roles no se ven afectadas por esta elusi\u00f3n. Este problema ha sido parcheado en las versiones 3.4.9 y 4.12.3."}], "id": "CVE-2026-33132", "lastModified": "2026-06-17T10:37:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33132", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T19:30:52.294049Z", "version": "2.0.3"}}]}, "published": "2026-03-20T11:18:02.857", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.3"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/zitadel: ZITADEL: Authentication bypass allows sign-in with other organization's users", "id": "2449597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449597"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in ZITADEL, an open-source identity management platform. A user could bypass organization enforcement during authentication due to missing controls in device authorization requests and specific login and OIDC API endpoints. This allowed users to sign in with credentials from other organizations, potentially leading to unauthorized information access."], "name": "CVE-2026-33132", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-multicluster-observability-addon-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-03-20T10:21:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33132\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33132\nhttps://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8\nhttps://github.com/zitadel/zitadel/releases/tag/v3.4.9\nhttps://github.com/zitadel/zitadel/releases/tag/v4.12.3\nhttps://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0-rc.1,4.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-rc.1,3.4.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,<1.80.0-v2.20.0.20260317120401-d90285929ca0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zitadel", "source": "cna", "vendor": "zitadel"}, "product": "zitadel", "vendor": "zitadel"}], "analysis": {"en": {"generated_at": "2026-03-23T19:24:07.870491+00:00", "value": {"mitigation_remediation": ["Apply the latest ZITADEL release (v3.4.9 or v4.12.3) to enforce organization scope checks in all authentication endpoints."], "summary": {"action": "Patch Immediately", "impact": "Authentication Bypass Allowing Cross\u2011Organization Logins"}, "threat_synthesis": {"affected_systems": "The issue affects ZITADEL open\u2011source identity management platform, specifically versions prior to 3.4.9 and 4.0.0 up to 4.12.2. Versions 3.4.9 and 4.12.3 contain the fix. Any deployment using the affected releases and relying on organization scope enforcement in authentication is vulnerable.", "description_and_impact": "ZITADEL lacks enforcement of organization scopes for several authentication pathways, enabling users to authenticate as members of other organizations. This flaw allows an attacker to sign in with credentials that belong to a different tenant, potentially granting unauthorized access to resources protected by that tenancy's policies. The weakness corresponds to missing authentication checks (CWE\u2011306) and improper authorization of resources (CWE\u2011863). The impact is the ability to perform unauthorized actions within another organization.", "risk_and_exploitability": "The CVSS score is 5.3, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation of the login V2, OIDC API V2, and device authorization flows, which all lack the necessary organization scope checks. An attacker who can craft authentication requests that specify organization scopes may obtain tokens for users in other organizations, leading to compromised tenant isolation."}}}}, "created": "2026-03-20T14:13:44.308106+00:00", "updated": "2026-03-25T14:29:33.786091+00:00", "vendors": ["zitadel", "zitadel$PRODUCT$zitadel"]}