CVE-2022-36051

    Dashboard / Vulnerabilities / CVE-2022-36051

    CVE-2022-36051

    Published: 31 Aug 2022Last Modified: 12 Aug 2026

    Summary: Broken Authorization in ZITADEL Actions

    Details: ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login. **Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organizations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability. There is currently no known workaround, users should update.

    References: https://github.com/zitadel/zitadel/releases/tag/v1.87.1, https://github.com/zitadel/zitadel/releases/tag/v2.2.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36051.json, https://github.com/zitadel/zitadel/security/advisories/GHSA-c8fj-4pm8-mp2c, https://nvd.nist.gov/vuln/detail/CVE-2022-36051

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ed80a8bb1e181b35f80907f068811471f3ef8ad6
    Fixed -cfb00c14a32d110224beb3282caa82f8f274ab93

    Affected versions

    v2.1.1
    v2.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36051 | CVE-DB