CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
Attackers can leak user data across tenants by exploiting identifier recycling, exposing users to unauthorized administrators in ZITADEL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55670?
CVE-2026-55670 is a low-severity vulnerability in zitadel, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.
Which versions are affected by CVE-2026-55670?
3 open source packages ship an affected version, including github.com/zitadel/zitadel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260615092437-6082e59d47c1 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260615092437-6082e59d47c1 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260615092437-6082e59d47c1 |
How do I fix CVE-2026-55670?
Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260615092437-6082e59d47c1 or later.
Is CVE-2026-55670 being exploited?
There is no known exploitation of CVE-2026-55670 in the wild and no public exploit code.
Sources
Also known as GHSA-6x8v-2fq5-2229, GO-2026-5197.