CVE-2026-23511 json
ZITADEL has a user enumeration vulnerability in Login UIs
published 9mo ago modified 4mo ago also EUVD-2026-2788 , GHSA-pvm5-9frx-264r , GO-2026-4319
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs. This vulnerability is fixed in 4.9.1 and 3.4.6.
Patch / fix
- go github.com/zitadel/zitadel 3.4.6, 4.9.1
- zitadel zitadel 3.4.6, 4.9.1
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260123T022811-150000.1.140.1
suse advisories SUSE-SU-2026:0292-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
Is CVE-2026-23511 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/zitadel/zitadel | >=4.0.0, <4.9.1 <3.4.6 all versions |
4.9.1 3.4.6 |
Affected products
- zitadel zitadel
Classification
References
-
github.com
/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2
web, patch
-
github.com
/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d
web, patch
-
github.com
/zitadel/zitadel/commit/0bb00dd9fc4e5e965f8e14fa2161a5076f3c308d
web, patch
-
github.com
/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r
web, third-party-advisory, advisory
-
github.com
/zitadel/zitadel/releases/tag/v3.4.6
web, release-notes
-
github.com
/zitadel/zitadel/releases/tag/v4.9.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-23511
advisory
-
github.com
/zitadel/zitadel
package
Sources
- CVE List CVE-2026-23511
- GitHub Advisory GHSA-pvm5-9frx-264r
- NVD CVE-2026-23511
- OSV GO-2026-4319
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.