ZITADEL Fixes Role Revocation Bug in Granted Projects

The ZITADEL project has addressed a medium-severity security vulnerability affecting versions 4.0.0 through 4.15.3 and 3.0.0 through 3.4.12, according to the GitHub Security Advisory database. The issue involved improper role revocation during the deletion of multiple roles in projects shared between organizations. Specifically, the bug caused the system to potentially skip over some roles during cleanup, allowing users to retain permissions that should have been removed. This vulnerability only impacted user grants on granted projects, not direct project roles or global organization roles.

The patch resolves the issue by correcting the logic that processes role deletions, ensuring no roles are skipped. Additionally, the update includes an automatic database migration that scans for and removes any lingering permissions caused by the bug. Operators should confirm that their systems are running the patched versions to avoid exposure to this issue. Before upgrading, it is critical to verify whether any granted projects have users with elevated permissions that were intended to be revoked, as the automatic migration may alter access configurations. This aligns with a broader pattern in cloud operations where database migrations tied to security fixes require careful pre-upgrade audits to prevent unintended access changes.