19 matches found
SUSE CVE-2026-55670
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
EUVD-2026-42977
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670
ZITADEL (open source identity management) prior to v4.15.2 is affected by a cross-tenant leakage in the event store validation: when a user is deleted, the original resource owner may remain associated with the deleted user’s ID and, if a new user is recreated in another organization with the sam...
CVE-2026-55670: Improper Access Control
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
django-allauth-ui (>=0.0.1, <=0.0.14), django-query-capture (>=0.1.0, <=0.2.6) +5 more potentially affected by CVE-2026-48588 via django (3.2.11)
django PYPI version 3.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-allauth-ui =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.0.2 - sphynxml 2.0.0 - workoutizer 0.24.0 Source cves: CVE-2026-48588 Source advisory:...
GHSA-6X8V-2FQ5-2229 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
Summary A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous I...
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
Summary A flaw in the user lifecycle enforcement allowed deleted users to retain their original organization/tenant association. Recreating a deleted user under a distinct organization can cause the new user instance to be incorrectly provisioned within the original organization if the previous I...
PT-2026-50739
Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.15.1 ZITADEL versions 3.0.0 through 3.4.11 Description A flaw in user lifecycle enforcement allows deleted users to retain their original organization or tenant association. When a user is deleted, the historic...
com.github.eventasia:event-store (>=0.0.1.release, <=0.0.3.release), com.github.eventasia:eventasia-starter (>=0.0.4.release, <=0.0.10.release) +4 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.0.2.release)
org.springframework.kafka:spring-kafka MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:event-store =0.0.1.release, =0.0.4.release,...
CVE-2025-13420
A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventStore.php. This manipulation of the argument eventSubject causes sql injection. The attack can be initiated remotely. The exploit has been ma...
CVE-2025-13420
A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventStore.php. This manipulation of the argument eventSubject causes sql injection. The attack can be initiated remotely. The exploit has been ma...
CVE-2025-13420
CVE-2025-13420 affects itsourcecode Human Resource Management System 1.0. The issue is a vulnerability in processing the eventSubject argument in /src/store/EventStore.php, enabling SQL injection. Exploitation is possible remotely and public exploits exist. Multiple sources (NVD, Red Hat, CVE lis...
django-allauth-ui (>=0.0.1, <=0.0.14), django-query-capture (>=0.1.0, <=0.2.6) +5 more potentially affected by CVE-2025-64459 via django (3.2.11)
django PYPI version 3.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-allauth-ui =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.0.2 - sphynxml 2.0.0 - workoutizer 0.24.0 Source cves: CVE-2025-64459 Source advisory:...
django-allauth-ui (>=0.0.1, <=0.0.14), django-query-capture (>=0.1.0, <=0.2.6) +5 more potentially affected by CVE-2025-64458 via django (3.2.11)
django PYPI version 3.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-allauth-ui =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.0.2 - sphynxml 2.0.0 - workoutizer 0.24.0 Source cves: CVE-2025-64458 Source advisory:...
