CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
13.0%
ZITADEL is vulnerable to Incorrect Authorization. The vulnerability is due to certain actions being able to set reserved claims managed by ZITADEL, such as urn:zitadel:iam:user:resourceowner:name. To address this, a protection mechanism has been introduced to prevent actions from altering claims starting with urn:zitadel:iam.
github.com/zitadel/zitadel/commit/ad0589d21d05d4210fcdf65bfe08ebeb5e31fa6e
github.com/zitadel/zitadel/releases/tag/v2.42.17
github.com/zitadel/zitadel/releases/tag/v2.43.11
github.com/zitadel/zitadel/releases/tag/v2.44.7
github.com/zitadel/zitadel/releases/tag/v2.45.5
github.com/zitadel/zitadel/releases/tag/v2.46.5
github.com/zitadel/zitadel/releases/tag/v2.47.8
github.com/zitadel/zitadel/releases/tag/v2.48.3
github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2