CVE-2026-33132

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints. This allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3.

• CWE-863

• https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8Patch
• https://github.com/zitadel/zitadel/releases/tag/v3.4.9Release Notes
• https://github.com/zitadel/zitadel/releases/tag/v4.12.3Release Notes
• https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9mPatch, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33125Frigate is a network video recorder (NVR) with realtime loca…8.1
• CVE-2026-33126Frigate is a network video recorder (NVR) with realtime loca…4.3
• CVE-2026-33128H3 is a minimal H(TTP) framework. In versions prior to 1.15.…10
• CVE-2026-33129H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 thro…5.9
• CVE-2026-33130Uptime Kuma is an open source, self-hosted monitoring tool. …6.5
• CVE-2026-33131H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2…9.1
• CVE-2026-33133WeGIA is a web manager for charitable institutions. In versi…7.2
• CVE-2026-33134WeGIA is a web manager for charitable institutions. Versions…8.8
• CVE-2026-33135WeGIA is a web manager for charitable institutions. Versions…6.1
• CVE-2026-33136WeGIA is a web manager for charitable institutions. Versions…6.1
• CVE-2026-33137XWiki Platform is a generic wiki platform offering runtime s…9.3
• CVE-2026-33139PySpector is a static analysis security testing (SAST) Frame…7.8