zitadel

0 Fork 0

mirror of https://github.com/zitadel/zitadel.git synced 2026-11-02 20:30:51 -06:00

Files

T

Livio Spring e891eb84af fix(api): permission checks for some management API endpoints

# Which Problems Are Solved

Some endpoints in the management API verified the user's permission but did not honor the organization the permission was granted in the internal process. This led to cross-tenant information disclosure.
The following endpoints were affected:

* `GetProjectByID`
* `GetGrantedProjectByID`
* `GetProjectGrantByID`
* `GetAppByID`
* `ListApps`
* `ListHumanAuthFactors`
* `ListHumanPasswordless`

# How the Problems Are Solved

Correctly treat the requested context (organization) where the permission was granted and use that to query the resource.

# Additional Changes

None

# Additional Context

- requires backport to v4.x and v3.x

(cherry picked from commit ab51fd9563)
(cherry picked from commit da227a458a)

# Conflicts:
#	internal/query/app.go

2026-03-11 08:45:13 +01:00

assets

chore!: Introduce ZITADEL v3 (#9645 )

2025-04-02 16:53:06 +02:00

authz

fix: sanitize host headers before use

2025-10-29 10:24:31 +01:00

call

fix: reset the call timestamp after a bulk trigger (#6080 )

2023-07-07 08:15:05 +00:00

grpc

fix(api): permission checks for some management API endpoints