CVE-2026-109374 zitadel CVE debrief

Who should care

Defenders responsible for ZITADEL deployments, particularly those with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles, should assess exposure and prioritize remediation.

Why it matters

Defenders should prioritize verifying and upgrading to version 4.19.2 or later, and review roles and claims for potential exposure to prevent privilege escalation and impersonation.

• Verify and upgrade to version 4.19.2 or later to prevent potential exploitation
• Review roles and claims to prevent potential impersonation
• Monitor for potential exploitation attempts to detect potential impact

Technical summary

The vulnerability allows end-user impersonators to impersonate administrators, including IAM_OWNER, by bypassing the admin.impersonation check in ZITADEL 3.0.0 before 4.19.2. This is achieved through the exploitation of the OIDC token exchange feature, which can be manipulated by attackers holding specific roles, such as IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR. The exploitation could lead to unauthorized access and privilege escalation within affected systems, emphasizing the need for defenders to review and mitigate the vulnerability promptly.

Defensive priority

Defenders should prioritize verifying and upgrading to version 4.19.2 or later, and review roles and claims for potential exposure.

Recommended defensive actions

• Verify and upgrade to version 4.19.2 or later
• Review roles and claims for potential exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or impact. Defenders should verify the affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations. The vulnerability's impact is primarily related to unauthorized access and potential privilege escalation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.