Vulnerability · Published Feb 26, 2026 · Assigned by GitHub_M
CVE-2026-27946ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
High 8.2
In plain English
A high-severity missing authorization in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zitadel/zitadel | 4.11.1 | GHSA-282g-fhmx-xf54 |
| Go | github.com/zitadel/zitadel | 3.4.7 | GHSA-282g-fhmx-xf54 |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20260225053417-0261536243e5 | GHSA-282g-fhmx-xf54 |
| Go | github.com/zitadel/zitadel | 1.80.0-v2.20.0.20260225053417-0261536243e5 | GO-2026-4572 |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54 x_refsource_CONFIRM