CVE-2026-109374
5.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Authenticated users with end-user impersonator roles can escalate privileges to full administrators, including IAM_OWNER, and sign in to relying applications with admin claims. An attacker already needs network access and either IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles in ZITADEL.
Root cause
An improper authorization check in OIDC token exchange bypasses the admin impersonation restriction for end-user impersonators.
Affected systems
ZITADEL 3.0.0 before 4.19.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade ZITADEL to version 4.19.2 or later. If you cannot patch immediately, audit and remove IAM_END_USER_IMPERSONATOR and ORG_END_USER_IMPERSONATOR role bindings from untrusted accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.