title: ZITADEL's actions can overload reserved claims
description: ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
problem types: CWE-863: Incorrect Authorization
affected:
{
vendor: zitadel
product: zitadel
versions:
version: < 2.42.17, status: affected
version: >= 2.43.0, < 2.43.11, status: affected
version: >= 2.44.0, < 2.44.7, status: affected
version: >= 2.45.0, < 2.45.5, status: affected
version: >= 2.46.0, < 2.46.5, status: affected
version: >= 2.47.0, < 2.47.8, status: affected
version: >= 2.48.0, < 2.48.3, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
]