ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read… (CVE-2026-105206)

The vulnerability in ZITADEL affects versions 3.0.0 through 3.4.15 and 4.x before 4.17.3. It is an incorrect authorization flaw in the User Service API where the user.read permission check is performed against the caller's organization rather than the organization owning the target user. This improper authorization allows an authenticated member with org-scoped user.read permission to retrieve information about authentication method types registered by users in other organizations by querying the GET /v2/users/{userId}/authentication_methods endpoint.

An authenticated user with user.read permission scoped to their own organization can access authentication method information of users in other organizations. This could lead to unauthorized disclosure of authentication method types, potentially aiding attackers in reconnaissance or targeted attacks. There is no indication of privilege escalation or direct account takeover from this flaw alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's advisories for updates. Until a fix is available, restrict user.read permissions carefully and avoid granting this permission broadly across organizations.