An improper access control vulnerability in ZITADEL Actions V1 allows privileged users to read server configuration files and escalate privileges to the instance administrator level.

The vulnerability exists in the goja Node-compatible require registry within ZITADEL Actions V1, which fails to restrict its filesystem source loader. An authenticated user with specific organization management permissions can exploit this to access arbitrary files readable by the server process, including sensitive credentials.

Successful exploitation poses a severe risk to the identity management environment, as it allows an organization administrator to bypass security boundaries and gain instance-level administrative control. This unauthorized access can lead to total compromise of the identity provider, including the theft of OIDC and SAML secrets. Given the CVSS score of 8.7, this is considered a high-severity risk requiring immediate attention to prevent unauthorized access to critical authentication infrastructure.

Immediate Action: Upgrade ZITADEL to version 3.4.13 or 4.16.1, as these releases contain the necessary security patches to restrict the filesystem source loader.

Proactive Monitoring: Review audit logs for suspicious activity originating from organization administrators, specifically monitoring for unusual file access attempts or modifications to Actions.

Compensating Controls: Restrict the ability to create or modify Actions to a strictly limited set of trusted personnel until the patch can be applied to the environment.

Public Exploit Available: No

The ability for an internal attacker to escalate privileges to the instance level represents a critical failure in the security model of the ZITADEL platform. Organizations using affected versions of ZITADEL must prioritize the deployment of the provided security updates. Failure to patch this vulnerability could lead to a complete compromise of the underlying identity infrastructure.