CVE-2026-32130General(zitadel / zitadel)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) API to provision users from external providers into Zitadel. Request to the API with URL-encoded path values were correctly routed but would bypass necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information such as names, email addresses, phone numbers, addresses, external IDs, and roles. Note that due to additional checks when manipulating data, an attacker could not modify or delete any user data. This vulnerability is fixed in 3.4.8 and 4.12.2.

zitadel CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/zitadel/zitadel/security/advisories/GHSA-83pv-4xxp-rm2x

Other references

Weakness type (CWE)

CWE-288

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

zitadel

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-03-11); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

zitadel

Products

zitadel

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-32130

Classification over time

Date	Total	Labels

2026-03-11	1	General1
2026-09-16	1	Disclosure1

Full discourse2 posts

Black@Bl4ckSec21d
Disclosure
🔎 CVE-2026-32130 — SCIM Auth Bypass Found a path normalization issue where encoding U as %55 bypassed authentication. GET /scim/v2/{org}/%55sers/{user_id} HTTP/2 /Users/... → 401 /%55sers/... → 200 OK The endpoint returned the SCIM user object without authentication. https://t.co/ePEyMEYFfi
Post summary
The tweet discloses CVE-2026-32130, describing a path‑normalization authentication bypass via %55 encoding that allows unauthenticated SCIM user access, and includes a link for further details.
22002171456.5K
506 followersView on X
CVE@CVEnew210d
General
CVE-2026-32130 ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) … https://www.cve.org/CVERecord?id=CVE-2026-32130
Post summary
The text references CVE-2026-32130 and links to the CVE record but provides no further details about exploitation, patches, or technical vulnerability specifics.
00000117
56.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	zitadel	zitadel	-	-	-

Explore more

Back to dashboard zitadel CVEs zitadel vulnerabilities