Back to feed
EUVD-2026-8794 · Published Feb 26, 2026
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Technologies
Zitadel Zitadel
Weaknesses
CWE-862
CVSS scores
- v4.08.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - v3.16.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Persistence Stealth Defense Impairment Credential Access
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54
- https://nvd.nist.gov/vuln/detail/CVE-2026-27946
- https://github.com/zitadel/zitadel/commit/0261536243e500dccfd8c7f547d592c822478327
- https://github.com/zitadel/zitadel
- https://github.com/zitadel/zitadel/releases/tag/v3.4.7
- https://github.com/zitadel/zitadel/releases/tag/v4.11.1
Potentially impacted assets
See if this affects your attack surface
