Threats tagged 'ghsa-cpf4-pmr4-w6cx'

ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated administrators of one organization to access and modify data of other organizations within the same instance. The vulnerability affects organization-level data such as name, domains, and metadata but does not impact users, projects, or applications. Versions from 4.0.0-rc.1 up to 4.6.2 are affected. The issue is fixed in version 4.6.3 and later. Mitigation includes upgrading to the patched version or disabling the vulnerable API endpoints via reverse proxy or WAF.