-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an Insecure Direct Object Reference (IDOR) in ZITADEL's Organization V2Beta API. The analysis of the patch commit 8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed reveals that multiple methods in the gRPC server implementation for the organization service were missing authorization checks. An authenticated user with administrator privileges in one organization could specify the ID of another organization in the API requests and perform actions on it without proper authorization.
The patch addresses this by introducing a permissionCheck function argument to the underlying business logic functions in the internal/command package. This check is then passed down from the gRPC handler. The gRPC handlers in internal/api/grpc/org/v2beta/org.go and internal/api/grpc/org/v2/org.go were modified to include these new permission checks (e.g., CheckPermissionOrganizationWrite, CheckPermissionOrganizationDelete).
The vulnerable functions are the public gRPC methods that were modified to include these checks. Before the patch, these functions would process requests without verifying if the caller had the necessary permissions for the target organization, leading to the IDOR vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | >= 4.0.0-rc.1, < 4.6.2 | 4.6.3 |
| github.com/zitadel/zitadel | go | >= 1.80.0-v2.20.0.20250414095945-f365cee73242, < 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 | 1.80.0-v2.20.0.20251105083648-8dcfff97ed52 |