ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
Description
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/zitadel/zitadelGo | >= 4.0.0, < 4.11.1 | 4.11.1 |
github.com/zitadel/zitadelGo | >= 2.43.0, < 3.4.7 | 3.4.7 |
github.com/zitadel/zitadelGo | < 1.80.0-v2.20.0.20260225053417-0261536243e5 | 1.80.0-v2.20.0.20260225053417-0261536243e5 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/zitadel/zitadelpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
>= 4.0.0, < 4.11.1+ 1 more
- (no CPE)range: >= 4.0.0, < 4.11.1
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-282g-fhmx-xf54ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27946ghsaADVISORY
- github.com/zitadel/zitadel/commit/0261536243e500dccfd8c7f547d592c822478327ghsaWEB
- github.com/zitadel/zitadel/releases/tag/v3.4.7ghsaWEB
- github.com/zitadel/zitadel/releases/tag/v4.11.1ghsaWEB
- github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.