Low severity · published Jul 10, 2026
CVE-2026-55670
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
2.3
CVSS
0.4%
EPSS
No
On KEV
Description
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original organization and exposed to that organization's administrator. This issue is fixed in version 4.15.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
zitadel · zitadel
< 4.15.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55670
github.com
https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46
github.com
https://github.com/zitadel/zitadel/pull/12261
github.com
https://github.com/zitadel/zitadel/releases/tag/v4.15.2
github.com
https://github.com/zitadel/zitadel/security/advisories/GHSA-6x8v-2fq5-2229
More from zitadel
9.8
CVE-2026-105207
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
9.8
CVE-2025-64717
ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
9.8
CVE-2025-64103
Zitadel Bypass Second Authentication Factor
9.8
CVE-2025-64102
Zitadel allows brute-forcing authentication factors
9.6
CVE-2026-105209
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment