EUVD-2026-342444

fkie_cve-2026-54693

ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.

GHSA-jq8w-8q2f-ffm9 — ZITADEL Users Can Self-Verify Email/Phone via API

Affected: Go: github.com/zitadel/zitadel

### Summary

A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.

While [`GHSA-282g-fhmx-xf54`](https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54) (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling `UpdateHumanUser` with `email.is_verified: true`, additional paths were discovered.

### Impact

Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.

Due to an improper permission check, the API allowed returning the verification code for the email and phone to the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.

Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.

### Affected Versions

Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.15.0` (including RC versions) - **3.x**: `3.0.0` through `3.4.10` (including RC versions) - **2.x**: `2.43.0` through `2.71.19`

### Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permissio…

Most recent entries from all

EUVD-2026-342444

fkie_cve-2026-54693

GHSA-jq8w-8q2f-ffm9 — ZITADEL Users Can Self-Verify Email/Phone via API