zitadel

0 Fork 0

mirror of https://github.com/zitadel/zitadel.git synced 2026-11-03 12:47:09 -06:00

Files

T

Tim Möhlmann 9be492dc00 fix(oidc): require admin.impersonation to impersonate administrators

Token exchange impersonation only checked the `impersonation`
permission, so an IAM_END_USER_IMPERSONATOR could impersonate any user,
including an IAM_OWNER.

Impersonating a user who holds any membership (instance, org, project
or project grant) now requires the `admin.impersonation` permission,
which only the *_ADMIN_IMPERSONATOR roles grant. The membership
projections are triggered before the check, which fails closed if the
trigger fails; triggerBatch now returns its context and error for this.
The permission check is scoped to the impersonated user again.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
(cherry picked from commit 9c047cc36d)

2026-09-28 06:26:01 +02:00

assets

fix: handle encoded paths in auth middleware

2026-03-11 08:28:38 +01:00

authz

fix: block Login V2 auth for users in deactivated organizations

2026-08-14 06:17:50 +02:00

call

fix: reset the call timestamp after a bulk trigger (#6080 )

2023-07-07 08:15:05 +00:00

grpc

perf(eventstore): order events API by creation date (#12789 )