Threats tagged 'ghsa-v859-c572-qh5p'

ZITADEL versions prior to 4.16.0 contain a bug in the role revocation process for User Grants on Granted Projects when multiple roles are deleted simultaneously. This bug can cause some user permissions to be missed during cleanup, potentially allowing users to retain elevated access that should have been removed. The issue does not affect direct project roles or global organization roles. The vulnerability has been fixed in version 4.16.0 with an update that includes an automatic database migration to correct any leftover permissions. No configuration workarounds exist; upgrading is the recommended remediation.