High priorityDisclosed

Advisory · CVE-2026-105213

ZITADEL ignores deactivated organizations at login

ZITADEL Login V2 checks only the individual user's status and not the organization's inactive state, so users of deactivated organizations can still sign in, create sessions, and refresh tokens.

Advisory published October 4, 2026Independent summary
Vendor
ZITADEL
Product
ZITADEL
Identifier / CWE
CVE-2026-105213
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

When a company is shut down in ZITADEL, the login page checks whether each person is still active but forgets to check whether their company still exists. Former employees with a saved login or an old session can keep walking in through a door that was supposed to be bricked up.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Organization deactivated

    An administrator deactivates an organization, expecting its users to lose access.

  2. 02Login checks user only

    Login V2 verifies the individual user's status but never checks the organization's inactive state.

  3. 03Access continues

    Users of the deactivated organization with valid credentials, an existing session, or a refresh token sign in and obtain or refresh tokens.

  4. 04Deprovisioning silently fails

    The organization keeps operating with live access after it was meant to be shut down.

What happened

ZITADEL 4.x before 4.17.1 does not check an organization’s inactive state during Login V2 authentication, verifying only the individual user’s status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens. It is rated high at CVSS 8.8 under CVSS v4.0 (8.2 under v3.1) and tracked as CWE-287.

What to do

  1. Upgrade ZITADEL to 4.17.1 or later.
  2. Review organizations that were deactivated while running an affected version and confirm their users can no longer authenticate after the upgrade.
  3. Invalidate sessions and refresh tokens issued to users of deactivated organizations.
  4. Treat this as a deprovisioning control failure: verify offboarding and org-shutdown procedures actually revoke access end to end.

Management note

Deprovisioning that does not actually deprovision is a quiet compliance and insider-risk problem. Unlike the takeover flaws in this batch, nobody needs to attack anything here; access simply never goes away. If your offboarding story depends on deactivating a ZITADEL organization, verify that story holds after upgrading.