{"vulnerability": "CVE-2026-76081", "sightings": [{"uuid": "0c2a17bb-a062-4b25-8fa1-fc980c116b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76081", "type": "seen", "source": "https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3", "content": "# CVE-2026-76081: CVE-2026-76081: Improper Role Revocation in ZITADEL Dynamic Project Grants\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76081\n\n## Summary\nCVE-2026-76081 is a logical vulnerability in ZITADEL's role cascading logic where updating a Project Grant to drop multiple adjacent roles simultaneously fails to clean up associated User Grants due to an in-place slice mutation error in Go.\n\n## TL;DR\nA slice mutation bug in ZITADEL's Go backend causes role cascading logic to skip adjacent roles during bulk revocation, leaving users with unauthorized permissions on shared projects.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-193 (Off-by-one Error)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.5 (Medium)\n- **Impact**: Improper Permission Revocation\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- **ZITADEL**: >= 4.0.0, < 4.16.0 (Fixed in: `4.16.0`)\n- **ZITADEL**: >= 3.0.0, <= 3.4.12 (Fixed in: `4.16.0`)\n\n## Mitigation\n\n- Upgrade to ZITADEL version 4.16.0 or higher to apply logical patch and run automated data migration.\n- Perform a database audit using the provided diagnostic SQL to locate and repair historically desynchronized user grants.\n\n**Remediation Steps:**\n1. Identify the current ZITADEL deployment version and database engine (PostgreSQL or CockroachDB).\n2. Back up the database transactional event store and related schema structures.\n3. Deploy ZITADEL v4.16.0 or higher binaries to trigger Setup Step 73 automatically.\n4. Verify completion of Setup Step 73 via startup logs or the migrations audit table.\n5. Execute the diagnostic SQL query against the database projections to ensure zero inconsistent records remain.\n\n## References\n\n- [ZITADEL Security Advisory GHSA-v859-c572-qh5p](https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p)\n- [ZITADEL Logical Fix Commit](https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59)\n- [ZITADEL Release v4.16.0](https://github.com/zitadel/zitadel/releases/tag/v4.16.0)\n- [CVE-2026-76081 Record](https://www.cve.org/CVERecord?id=CVE-2026-76081)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76081) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-14T22:32:03.298228Z"}, {"uuid": "6088f6fc-d71b-47d4-9f44-7052e32f3512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76081", "type": "seen", "source": "https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3", "content": "# CVE-2026-76081: CVE-2026-76081: Improper Role Revocation in ZITADEL Dynamic Project Grants\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76081\n\n## Summary\nCVE-2026-76081 is a logical vulnerability in ZITADEL's role cascading logic where updating a Project Grant to drop multiple adjacent roles simultaneously fails to clean up associated User Grants due to an in-place slice mutation error in Go.\n\n## TL;DR\nA slice mutation bug in ZITADEL's Go backend causes role cascading logic to skip adjacent roles during bulk revocation, leaving users with unauthorized permissions on shared projects.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-193 (Off-by-one Error)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.5 (Medium)\n- **Impact**: Improper Permission Revocation\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- **ZITADEL**: >= 4.0.0, < 4.16.0 (Fixed in: `4.16.0`)\n- **ZITADEL**: >= 3.0.0, <= 3.4.12 (Fixed in: `4.16.0`)\n\n## Mitigation\n\n- Upgrade to ZITADEL version 4.16.0 or higher to apply logical patch and run automated data migration.\n- Perform a database audit using the provided diagnostic SQL to locate and repair historically desynchronized user grants.\n\n**Remediation Steps:**\n1. Identify the current ZITADEL deployment version and database engine (PostgreSQL or CockroachDB).\n2. Back up the database transactional event store and related schema structures.\n3. Deploy ZITADEL v4.16.0 or higher binaries to trigger Setup Step 73 automatically.\n4. Verify completion of Setup Step 73 via startup logs or the migrations audit table.\n5. Execute the diagnostic SQL query against the database projections to ensure zero inconsistent records remain.\n\n## References\n\n- [ZITADEL Security Advisory GHSA-v859-c572-qh5p](https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p)\n- [ZITADEL Logical Fix Commit](https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59)\n- [ZITADEL Release v4.16.0](https://github.com/zitadel/zitadel/releases/tag/v4.16.0)\n- [CVE-2026-76081 Record](https://www.cve.org/CVERecord?id=CVE-2026-76081)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76081) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T00:00:09.560207Z"}]}