CVSS 4.0
8.2 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:NCVE-2026-27946
High (8.2) in zitadel zitadel. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/zitadel/zitadel 1.80.0-v2.20.0.20260225053417-0261536243e5, 3.4.7, 4.11.1.
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zitadel:zitadel
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-282g-fhmx-xf54 | Go | github.com/zitadel/zitadel | >=4.0.0 <4.11.1 | 4.11.1 |
| GHSA-282g-fhmx-xf54 | Go | github.com/zitadel/zitadel | >=2.43.0 <3.4.7 | 3.4.7 |
| GHSA-282g-fhmx-xf54 | Go | github.com/zitadel/zitadel | <1.80.0-v2.20.0.20260225053417-0261536243e5 | 1.80.0-v2.20.0.20260225053417-0261536243e5 |
| GO-2026-4572 | Go | github.com/zitadel/zitadel | <1.80.0-v2.20.0.20260225053417-0261536243e5 | 1.80.0-v2.20.0.20260225053417-0261536243e5 |