{"id":"CVE-2024-29892","aliases":["GHSA-gp8g-f42f-95q2","GO-2024-2664"],"url":"https://o3.security/vulnerability/CVE-2024-29892","summary":"ZITADEL's actions can overload reserved claims","details":"### Impact\nUnder certain circumstances an action could set [reserved claims](https://zitadel.com/docs/apis/openidoauth/claims#reserved-claims) managed by ZITADEL.\n\nFor example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`\n\n```json\n{\"urn:zitadel:iam:user:resourceowner:name\": \"ACME\"}\n```\n\nif it was not set by ZITADEL itself.\n\nTo compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`\n\n### Patches\n2.x versions are fixed on >= [2.48.3](https://github.com/zitadel/zitadel/releases/tag/v2.48.3)\n2.47.x versions are fixed on >= [2.47.8](https://github.com/zitadel/zitadel/releases/tag/v2.47.8)\n2.46.x versions are fixed on >= [2.46.5](https://github.com/zitadel/zitadel/releases/tag/v2.46.5)\n2.45.x versions are fixed on >= [2.45.5](https://github.com/zitadel/zitadel/releases/tag/v2.45.5)\n2.44.x versions are fixed on >= [2.44.7](https://github.com/zitadel/zitadel/releases/tag/v2.44.7)\n2.43.x versions are fixed on >= [2.43.11](https://github.com/zitadel/zitadel/releases/tag/v2.43.11)\n2.42.x versions are fixed on >= [2.42.17](https://github.com/zitadel/zitadel/releases/tag/v2.42.17)\n\n### Workarounds\nNo workaround available since a patch is available\n\n### Credits\nMany thanks to @schettn whose disclosure of another topic lead us to find this issue.\n","published":"2024-03-27T19:59:24.734Z","modified":"2026-10-28T02:30:20.540715540Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.42.17"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.43.11"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.44.7"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.45.5"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.46.5"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.47.8"},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"2.48.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.42.17"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.43.11"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.44.7"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.45.5"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.46.5"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.47.8"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v2.48.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29892.json"},{"type":"ADVISORY","url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29892"},{"type":"PACKAGE","url":"https://github.com/zitadel/zitadel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:20.540715540Z"}}