{"cve":"CVE-2026-76081","nvd":{"published":"2026-09-14T22:16:57.910","modified":"2026-09-16T13:42:48.413","status":"Deferred","description":"ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects (projects shared between different organizations), potentially allowing users to keep access rights that were supposed to be completely removed. This issue has been fully resolved in version 4.16.0. There are no configuration workarounds. Upgrading to a patched version is the only way to trigger the automatic cleanup migration. Those who cannot upgrade immediately should manually review user permissions specifically for Granted Projects where multiple roles were recently deleted.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.5},"cwes":["CWE-193"],"references":["https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59","https://github.com/zitadel/zitadel/releases/tag/v4.16.0","https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-76081","score":0.00397,"percentile":0.33955,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v859-c572-qh5p","url":"https://osv.dev/vulnerability/GHSA-v859-c572-qh5p","summary":"ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions","modified":"2026-09-17T17:41:02.397511368Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["<4.16.0"],"fixed":["4.16.0"]}]},{"id":"GO-2026-6473","url":"https://osv.dev/vulnerability/GO-2026-6473","summary":"ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel","modified":"2026-09-17T17:30:12.905223394Z","packages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}