Medium severity · published Oct 4, 2026
CVE-2026-105206
ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
zitadel · zitadel
before 4.17.3; through 4.19.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105206
vendor-advisory
https://github.com/zitadel/zitadel/security/advisories/GHSA-j344-gqv4-84ff
third-party-advisory
https://www.vulncheck.com/advisories/zitadel-before-4.17.3-cross-organization-authentication-method-enumeration-via-user-service
More from zitadel
9.8
CVE-2026-105207
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
9.8
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
9.8
CVE-2025-64103
Zitadel Bypass Second Authentication Factor
9.8
CVE-2025-64102
Zitadel allows brute-forcing authentication factors
9.6
CVE-2026-105209
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment