CVE-2026-105209 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL instances, particularly those with multi-organization setups, should assess exposure and apply remediation. This includes verifying ZITADEL instance version, assessing organizational access controls and user-write permissions, and monitoring for suspicious authenticator registration activity.

Why it matters

CVE-2026-105209 is a critical vulnerability in ZITADEL that allows attackers to take over accounts across organizations. Defenders should prioritize verifying ZITADEL instances for exposure, assessing organizational access controls, and applying vendor remediation.

• Account takeover across organizations
• Unauthorized access to sensitive data
• Elevation of privileges for attackers
• Potential for lateral movement within the instance

Technical summary

The vulnerability allows attackers with user-write permission in one organization to obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account. This is possible because the system checks only the organization in the x-zitadel-orgid header, not the target user's organization. The vulnerability affects ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1, and defenders should prioritize verifying ZITADEL instances for exposure and applying vendor remediation.

Defensive priority

Defenders should prioritize verifying ZITADEL instances for exposure, assessing organizational access controls, and applying vendor remediation.

Recommended defensive actions

• Verify ZITADEL instance version and apply vendor remediation
• Assess organizational access controls and user-write permissions
• Monitor for suspicious authenticator registration activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its exploitation and impact require verification from official sources. The vulnerability's description indicates a high severity level, with a CVSS score of 9.3, and defenders should verify ZITADEL instances for exposure, assess organizational access controls, and apply vendor remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.