Summary
ZITADEL Actions V1 permits organization Action authors with specific organization permissions to execute JavaScript that can read files accessible to the ZITADEL server process.
This may expose mounted configuration and bootstrap secrets, potentially enabling escalation from an organization administrator to an instance administrator when vulnerable Actions and trigger flows are enabled.
Affected context
The issue occurs in ZITADEL Actions V1 deployments within affected release ranges when the Node-compatible require() registry is available without restricting its filesystem source loader. Exploitation depends on an organization Action author having ORG_OWNER, org.action.write, and org.flow.write permissions, with the Action invoked at an OIDC, SAML, or login-flow trigger point. Files readable by the ZITADEL server process, including certain mounted configuration and bootstrap credential files, may therefore be exposed. Host command execution has not been established.
Exploit preconditions
- Attack surface: ZITADEL Actions V1 JavaScript execution and the Node-compatible
require()registry - Required access: An organization Action author with
ORG_OWNER,org.action.write, andorg.flow.writepermissions - Trigger point: An enabled OIDC, SAML, or login-flow Action trigger
- File access condition: The target files must be readable by the ZITADEL server process
- Why exploitation is possible: The filesystem-backed module loader is not sufficiently restricted, allowing Action code to access readable files beyond its intended application scope
Why this happens
The underlying issue is an access-control failure in the integration between the JavaScript runtime and its module-loading mechanism. Actions V1 exposes a Node-compatible require() registry while permitting a filesystem source loader without an adequate path or capability boundary. Consequently, code authored within an organization-controlled Action can access files according to the server process identity rather than a narrowly defined Action-specific policy. This behavior maps to CWE-284: Improper Access Control, because authorization boundaries do not adequately constrain access to protected filesystem resources.
Potential impact
- Sensitive configuration files may be disclosed
- Mounted secrets and bootstrap credentials could be exposed
- Credentials associated with configured login clients or machine keys may be recovered
- An organization administrator could potentially escalate to instance-administrator privileges
- OIDC, SAML, or login-flow processing may be influenced through unauthorized Action behavior
- Broader compromise could occur if exposed credentials are valid outside the immediate service
General mitigation guidance
Mitigation generally focuses on reducing the authority and filesystem reach of user-authored Actions.
Common defensive patterns include:
- Disable or remove Actions V1 flows that do not require JavaScript execution
- Restrict module loading to an explicit, allowlisted set of built-in or application-owned modules
- Prevent Action code from resolving arbitrary filesystem-backed modules
- Apply least-privilege identities and filesystem permissions to the ZITADEL server process
- Keep bootstrap credentials outside broadly readable mounts and avoid exposing secret-bearing paths to application processes
- Separate organization-level Action administration from instance-level security administration
- Rotate credentials that may have been readable by affected Action execution contexts
- Use a supported security-maintained release line containing the relevant corrective controls
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis and policy checks for unrestricted
require()or filesystem-backed module loaders in embedded JavaScript runtimes - Code review signals showing user-authored scripts with access to server-local files or dynamic module resolution
- Inventory reviews of Actions V1, their authors, assigned permissions, and OIDC, SAML, or login-flow trigger bindings
- Audit-log searches for unexpected Action creation, modification, or execution by organization administrators
- File-access monitoring for reads of configuration, credential, secret, or bootstrap paths by the ZITADEL process
- Policy enforcement that blocks Action execution unless module access and filesystem capabilities are explicitly approved
- Automated security review tools configured to flag missing path restrictions and privilege-boundary violations
