ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate… (CVE-2026-109374)

CVE-2026-109374 describes a privilege escalation vulnerability in ZITADEL's OIDC token exchange mechanism affecting versions from 3.0.0 before 4.19.2. Attackers possessing IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can bypass the admin.impersonation check, allowing them to impersonate administrators such as IAM_OWNER. This results in unauthorized administrative access to relying applications with the roles and claims of the impersonated administrator. The vulnerability is classified under CWE-863 (Incorrect Authorization).

An attacker with end-user impersonator roles can escalate privileges to administrator level, including the IAM_OWNER role, potentially gaining unauthorized administrative access to applications relying on ZITADEL for authentication. This could lead to unauthorized actions performed with administrative privileges, impacting confidentiality and integrity of the system. The CVSS 3.1 score is 5.5 (medium), indicating a moderate risk.

The vulnerability affects ZITADEL versions prior to 4.19.2. Users should upgrade to version 4.19.2 or later where this issue is fixed. Since this is not a cloud service, remediation requires applying the official patch or upgrade provided by the vendor. Patch status is not explicitly confirmed in the input data, but the version boundary indicates a fix in 4.19.2. Check the vendor advisory for the latest remediation guidance.