CVE-2026-105209

Summary

This vulnerability allows attackers with user-write permission in one organization to obtain an enrollment code for a user in another organization, potentially leading to account takeover.

Exploitability

Exploitation is relatively straightforward given the required user-write permission in one organization, and the attacker can then obtain an enrollment code for a user in another organization.

Blast radius

If exploited, the impact is high as attackers can take over accounts in different organizations, leading to potential data breaches and unauthorized access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ZITADEL 3.4.15 or 4.17.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.