https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 23:35:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-271309 EUVD-2026-271309 https://cve.radiocsirt.org/vuln/euvd-2026-271309 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27946 <p>ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel&#39;s self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.</p> <p>ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel&#39;s self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27946 https://cve.radiocsirt.org/vuln/ghsa-282g-fhmx-xf54 <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel&#39;s self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.</p> <p>### Impact</p> <p>Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.</p> <p>Due to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.</p> <p>Note that when changing another user&#39;s email or phone, regardless of the verification flag, the permissions were correctly checked.</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.11.0` (including RC versions) - **3.x**: `3.0.0` through `3.4.6` (including RC versions) - **2.x**: `2.43.0` through `2.71.19`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.</p> <p>4.x: Upgrade to &gt;=[4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) 3.x: Update to &gt;=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7) 2.x: Update to &gt;=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)</p> <p>### Workarounds</p> <p>The recommen…</p> <p><strong>Affected:</strong> Go: github.com/zitadel/zitadel</p> <p>### Summary</p> <p>A vulnerability in Zitadel&#39;s self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.</p> <p>### Impact</p> <p>Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.</p> <p>Due to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.</p> <p>Note that when changing another user&#39;s email or phone, regardless of the verification flag, the permissions were correctly checked.</p> <p>### Affected Versions</p> <p>Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.11.0` (including RC versions) - **3.x**: `3.0.0` through `3.4.6` (including RC versions) - **2.x**: `2.43.0` through `2.71.19`</p> <p>### Patches</p> <p>The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.</p> <p>4.x: Upgrade to &gt;=[4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) 3.x: Update to &gt;=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7) 2.x: Update to &gt;=[3.4.7](https://github.com/zitadel/zitadel/releases/tag/v3.4.7)</p> <p>### Workarounds</p> <p>The recommen…</p> https://cve.radiocsirt.org/vuln/ghsa-282g-fhmx-xf54