ZITADEL Actions V1 allows an organization action author with high‑level permissions to run JavaScript that accesses the underlying file system through the Node‑compatible require() function. This escape bypasses sandbox restrictions, enabling the attacker to read any file the ZITADEL server process can access, such as mounted configuration files, secrets stored in ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and bootstrap credentials. The leak of these credentials can elevate an attacker from an organization administrator to an instance administrator, providing full control over the deployment.

The affected product is ZITADEL, the open source identity platform. Versions from 3.0.0 up to and including 3.4.12, as well as from the early 4.x line up to 4.16.0, contain the vulnerability. The fix was released in ZITADEL v3.4.13 and v4.16.1, which remove the unrestricted file‑system loader from Actions V1.

The CVSS score of 8.7 indicates a high severity with excellent impact. EPSS is currently unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, since the exploit requires an attacker to possess ORG_OWNER, org.action.write, and org.flow.write roles, it is limited to individuals with organizational leadership permissions. If an organization’s internal users or external actors compromise such roles, the attacker can read sensitive files and elevate privileges without executing arbitrary code.