DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-76081: CVE-2026-76081: Improper Role Revocation in ZITADEL Dynamic Project Grants

#security #cve #cybersecurity

CVE-2026-76081: Improper Role Revocation in ZITADEL Dynamic Project Grants

Vulnerability ID: CVE-2026-76081
CVSS Score: 5.5
Published: 2026-09-14

CVE-2026-76081 is a logical vulnerability in ZITADEL's role cascading logic where updating a Project Grant to drop multiple adjacent roles simultaneously fails to clean up associated User Grants due to an in-place slice mutation error in Go.

TL;DR

A slice mutation bug in ZITADEL's Go backend causes role cascading logic to skip adjacent roles during bulk revocation, leaving users with unauthorized permissions on shared projects.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-193 (Off-by-one Error)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.5 (Medium)
  • Impact: Improper Permission Revocation
  • Exploit Status: Proof of Concept Available
  • CISA KEV Status: Not Listed

Affected Systems

  • ZITADEL Identity Platform
  • ZITADEL: >= 4.0.0, < 4.16.0 (Fixed in: 4.16.0)
  • ZITADEL: >= 3.0.0, <= 3.4.12 (Fixed in: 4.16.0)

Code Analysis

Commit: 9d60e83

Fix user grant role cascade deletion logic and implement Setup Step 73 database migration

Exploit Details

Mitigation Strategies

  • Upgrade to ZITADEL version 4.16.0 or higher to apply logical patch and run automated data migration.
  • Perform a database audit using the provided diagnostic SQL to locate and repair historically desynchronized user grants.

Remediation Steps:

  1. Identify the current ZITADEL deployment version and database engine (PostgreSQL or CockroachDB).
  2. Back up the database transactional event store and related schema structures.
  3. Deploy ZITADEL v4.16.0 or higher binaries to trigger Setup Step 73 automatically.
  4. Verify completion of Setup Step 73 via startup logs or the migrations audit table.
  5. Execute the diagnostic SQL query against the database projections to ensure zero inconsistent records remain.

References

Read the full report for CVE-2026-76081 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)