« Back to list

CVE-2026-32130

Status: AnalyzedHigh (7.5)—

ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) API to provision users from external providers into Zitadel. Request to the API with URL-encoded path values were correctly routed but would bypass necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information such as names, email addresses, phone numbers, addresses, external IDs, and roles. Note that due to additional checks when manipulating data, an attacker could not modify or delete any user data. This vulnerability is fixed in 3.4.8 and 4.12.2.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Red sin autenticación (AV:N, PR:N, UI:N). Acceso a SCIM API con bypass de autenticación expone datos sensibles (nombres, emails, teléfonos, IDs externos, roles) sin modificación. CWE-288 confirma fallo de autenticación.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account ManagementUser Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Developer GuidanceActive Directory Configuration

Affected technologies (1)

Zitadel — Zitadel

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-32130",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32130",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T15:15:07.742217Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.12.2"
            },
            {
              "status": "affected",
              "version": ">= 2.68.0, < 3.4.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-11T22:16:32.793",
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.8",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.12.2",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-83pv-4xxp-rm2x",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) API to provision users from external providers into Zitadel. Request to the API with URL-encoded path values were correctly routed but would bypass necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information such as names, email addresses, phone numbers, addresses, external IDs, and roles. Note that due to additional checks when manipulating data, an attacker could not modify or delete any user data. This vulnerability is fixed in 3.4.8 and 4.12.2."
    },
    {
      "lang": "es",
      "value": "ZITADEL es una plataforma de gestión de identidades de código abierto. Desde la versión 2.68.0 hasta antes de la 3.4.8 y la 4.12.2, Zitadel proporciona una API de System for Cross-domain Identity Management (SCIM) para aprovisionar usuarios de proveedores externos en Zitadel. Las solicitudes a la API con valores de ruta codificados en URL se enrutaban correctamente, pero omitían las comprobaciones necesarias de autenticación y permisos. Esto permitía a atacantes no autenticados recuperar información sensible como nombres, direcciones de correo electrónico, números de teléfono, direcciones, IDs externos y roles. Tenga en cuenta que, debido a comprobaciones adicionales al manipular datos, un atacante no podía modificar ni eliminar ningún dato de usuario. Esta vulnerabilidad está corregida en 3.4.8 y 4.12.2."
    }
  ],
  "lastModified": "2026-06-17T10:35:11.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DB277C2-4C29-4B79-A57E-996ACDC20F03",
              "versionEndExcluding": "3.4.8",
              "versionStartIncluding": "2.68.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22086237-3579-411C-806B-D740008579B0",
              "versionEndExcluding": "4.12.2",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}