-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks when processing custom claims in actions. The patch commits (e.g. c4c34cb, ad0589d) mention adding protection against custom urn:zitadel:iam claims, indicating the vulnerable code was in the claim processing path. While exact function names aren't visible, ZITADEL's architecture suggests flow.go handles action processing. The confidence is high because: 1) The vulnerability directly relates to claim processing 2) Fix commits explicitly mention claim validation improvements 3) Multiple release notes confirm the pattern of adding reserved claim validation
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 2.42.17 | 2.42.17 |
| github.com/zitadel/zitadel | go | >= 2.43.0, < 2.43.11 | 2.43.11 |
| github.com/zitadel/zitadel | go | >= 2.44.0, < 2.44.7 | 2.44.7 |
| github.com/zitadel/zitadel | go | >= 2.45.0, < 2.45.5 | 2.45.5 |
| github.com/zitadel/zitadel | go | >= 2.46.0, < 2.46.5 | 2.46.5 |
| github.com/zitadel/zitadel | go | >= 2.47.0, < 2.47.8 | 2.47.8 |
| github.com/zitadel/zitadel | go | >= 2.48.0, < 2.48.3 | 2.48.3 |
Ongoing coverage of React2Shell