x/vulndb: potential Go vuln in github.com/zitadel/zitadel/v2: GHSA-2w5j-qfvw-2hf5

[GoVulnBot]

Advisory GHSA-2w5j-qfvw-2hf5 references a vulnerability in the following Go modules:

Module
github.com/zitadel/zitadel

Description:

Impact

ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources.
Additionally, the management and auth API always returned the state as active or did not provide any information about the state.

Patches

2.x versions are fixed on >= 2.62.1
2.61.x versions are fixed on >= 2.61.1
2.60.x versions are fixed on >= [2.60.2](https://github.c...

References:

• ADVISORY: GHSA-2w5j-qfvw-2hf5
• ADVISORY: GHSA-2w5j-qfvw-2hf5

Cross references:

• github.com/zitadel/zitadel appears in 15 other report(s):
  • data/excluded/GO-2022-0961.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2022-36051 #961) NOT_IMPORTABLE
  • data/excluded/GO-2023-1489.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-6rrr-78xp-5jp8 #1489) NOT_IMPORTABLE
  • data/excluded/GO-2023-2107.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2023-44399 #2107) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2155.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2023-46238 #2155) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2187.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-7h8m-vrxx-vr4m #2187) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2368.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-2wmj-46rj-qm2w #2368) NOT_IMPORTABLE
  • data/reports/GO-2024-2637.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-mq4x-r2w3-j7mr #2637)
  • data/reports/GO-2024-2655.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-hfrg-4jwr-jfpj #2655)
  • data/reports/GO-2024-2664.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-gp8g-f42f-95q2 #2664)
  • data/reports/GO-2024-2665.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-hr5w-cwwq-2v4m #2665)
  • data/reports/GO-2024-2788.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: GHSA-7j7j-66cv-m239 #2788)
  • data/reports/GO-2024-2804.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-32967 #2804)
  • data/reports/GO-2024-2968.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-39683 #2968)
  • data/reports/GO-2024-3014.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-41952 #3014)
  • data/reports/GO-2024-3015.yaml (x/vulndb: potential Go vuln in github.com/zitadel/zitadel: CVE-2024-41953 #3015)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/zitadel/zitadel
      non_go_versions:
        - fixed: 2.54.10
        - introduced: 2.55.0
        - fixed: 2.55.8
        - introduced: 2.56.0
        - fixed: 2.56.6
        - introduced: 2.57.0
        - fixed: 2.57.5
        - introduced: 2.58.0
        - fixed: 2.58.5
        - introduced: 2.59.0
        - fixed: 2.59.3
        - introduced: 2.60.0
        - fixed: 2.60.2
        - introduced: 2.61.0
        - fixed: 2.61.1
        - introduced: 2.62.0
        - fixed: 2.62.1
      vulnerable_at: 1.87.5
summary: ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel
ghsas:
    - GHSA-2w5j-qfvw-2hf5
references:
    - advisory: https://github.com/advisories/GHSA-2w5j-qfvw-2hf5
    - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-2w5j-qfvw-2hf5
source:
    id: GHSA-2w5j-qfvw-2hf5
    created: 2024-09-19T17:01:24.548793356Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/616059 mentions this issue: data/reports: add 13 unreviewed reports

[gopherbot]

Change https://go.dev/cl/616060 mentions this issue: data/reports: add 11 unreviewed reports