CVE-2026-27946
published 2026-02-26CVE-2026-27946: ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.18%
7.3th percentile
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 0 < 1.80.0-v2.20.0.20260225053417-0261536243e5 | 1.80.0-v2.20.0.20260225053417-0261536243e5 |
| github.com | zitadel_zitadel | >= 2.43.0 < 3.4.7 | 3.4.7 |
| github.com | zitadel_zitadel | >= 4.0.0 < 4.11.1 | 4.11.1 |
| zitadel | zitadel | < 3.4.7 | 3.4.7 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | >= 4.0.0 < 4.11.0 | 4.11.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel
osv·2026-03-10
CVE-2026-27946 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/zitadel/zitadel from v2.43.0 before v3.4.7, from v4.0.0 before v4.11.1.
GHSA
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ghsa·2026-02-27
CVE-2026-27946 [HIGH] CWE-862 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
### Summary
A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.
### Impact
Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.
Due to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user.
This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.
Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.
### Affected V
OSV
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
osv·2026-02-27
CVE-2026-27946 [HIGH] ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
### Summary
A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.
### Impact
Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.
Due to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user.
This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.
Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.
### Affected V
No detection rules found.
No public exploits indexed.
2026-02-26
Published