This vulnerability in Zitadel's Management API allows an authenticated user with a low‑privilege token (e.g., project.read, project.grant.read, or project.app.read) to retrieve management‑plane data belonging to other organizations by specifying a different tenant’s project_id, grant_id, or app_id. Because the API does not enforce tenancy boundaries, the attacker can read configuration and sensitive information from another tenant, leading to confidentiality loss. The weakness corresponds to CWE‑639 (Authorization Bypass Through Privilege Escalation) and CWE‑862 (Missing Authorization).

Affected vendors and products: Zitadel; platform: Zitadel identity management. Version information is inferred from the advisory text: all releases prior to 3.4.8 in the 3.x branch and all releases prior to 4.12.2 in the 4.x branch are vulnerable.

Risk and exploitability: The CVSS score is 7.7, indicating a high severity. EPSS is under 1%, showing a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only an authenticated low‑privilege token, making it trivially achievable by any legitimate user or by an attacker who has hijacked such a token. Immediate patching is strongly recommended to eliminate the data leakage risk.