CVE-2026-27946
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Feb 26, 2026
CISA due date
—
The record
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 0 | 1.80.0-v2.20.0.20260225053417-0261536243e5 |
| Go | github.com/zitadel/zitadel | 2.43.0 | 3.4.7 |
| Go | github.com/zitadel/zitadel | 4.0.0 | 4.11.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- GHSA-282g-fhmx-xf54 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API Same vulnerability
- CVE-2026-29067 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel
- GHSA-6mq3-xmgp-pjm5 ZITADEL's truncated opaque tokens are still valid Also affects github.com/zitadel/zitadel
- CVE-2026-27840 ZITADEL is an open source identity management platform. Also affects github.com/zitadel/zitadel
- GO-2026-4319 Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel Also affects github.com/zitadel/zitadel
- CVE-2026-23511 Zitadel has a user enumeration vulnerability in Login UIs Also affects github.com/zitadel/zitadel
- GO-2025-4227 Zitadel Discloses the Total Number of Instance Users in github.com/zitadel/zitadel Also affects github.com/zitadel/zitadel
- GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in… Also affects github.com/zitadel/zitadel