CVE-2026-76081: ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

September 14, 2026

A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed.

References

github.com/advisories/GHSA-v859-c572-qh5p
github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59
github.com/zitadel/zitadel/releases/tag/v4.16.0
github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p
nvd.nist.gov/vuln/detail/CVE-2026-76081

Code Behaviors & Features

Detect and mitigate CVE-2026-76081 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →