CVE-2026-27946: ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API
Summary
A vulnerability in ZITADEL's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.
Impact
ZITADEL provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.
Due to an improper permission check, the API allowed setting the verified flag for the email and phone on the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.
Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.
Affected Versions
Systems running one of the following versions are affected: - 4.x: 4.0.0 through 4.11.0 (including RC versions) - 3.x: 3.0.0 through 3.4.6 (including RC versions) - 2.x: 2.43.0 through 2.71.19
Patches
The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.
4.x: Upgrade to >=4.11.1 3.x: Update to >=3.4.7 2.x: Update to >=3.4.7
Workarounds
The recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Questions
If there are any questions or comments about this advisory, please send an email to security@zitadel.com
Other sources
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27946?
CVE-2026-27946 is classified with moderate severity due to its potential misuse in bypassing user verification processes.
What impact does CVE-2026-27946 have on user accounts?
The impact of CVE-2026-27946 allows users to self-verify their email or phone numbers without completing the actual verification process, leading to possible account fraud.
How do I fix CVE-2026-27946?
To fix CVE-2026-27946, update ZITADEL to version 4.11.1 or later, or version 3.4.7 if using an earlier release.
Which versions of ZITADEL are affected by CVE-2026-27946?
CVE-2026-27946 affects ZITADEL versions prior to 4.11.1 and prior to 3.4.7.
Can CVE-2026-27946 be exploited without authentication?
Yes, CVE-2026-27946 can be exploited by authenticated users who can access the UpdateHumanUser API.