CVE-2026-32131 | Zitadel up to 3.4.7/4.12.1 Organization project.app.read project_id/grant_id/app_id authorization (GHSA-wr6r-59xg-4pj2)

A vulnerability described as problematic has been identified in Zitadel up to 3.4.7/4.12.1. This vulnerability affects the function project.app.read of the component Organization Handler. The manipulation of the argument project_id/grant_id/app_id results in authorization bypass.

This vulnerability was named CVE-2026-32131. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.