CVE-2026-23511 json
ZITADEL has a user enumeration vulnerability in Login UIs
published 2026-01-15 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-2788 , GHSA-pvm5-9frx-264r , GO-2026-4319
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.
Patch / fix
- go github.com/zitadel/zitadel 3.4.6, 4.9.1
- zitadel zitadel 3.4.6, 4.9.1
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260123T022811-150000.1.140.1
suse advisories SUSE-SU-2026:0292-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/zitadel/zitadel | >=4.0.0, <4.9.1 <3.4.6 all versions |
4.9.1 3.4.6 |
Affected products
- zitadel zitadel
Classification
References
-
github.com
/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2
web, patch
-
github.com
/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d
web, patch
-
github.com
/zitadel/zitadel/commit/0bb00dd9fc4e5e965f8e14fa2161a5076f3c308d
web, patch
-
github.com
/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r
web, third-party-advisory, advisory
-
github.com
/zitadel/zitadel/releases/tag/v3.4.6
web, release-notes
-
github.com
/zitadel/zitadel/releases/tag/v4.9.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-23511
advisory
-
github.com
/zitadel/zitadel
package
Sources
- CVE List CVE-2026-23511
- GitHub Advisory GHSA-pvm5-9frx-264r
- NVD CVE-2026-23511
- OSV GO-2026-4319
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.