Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
`ZITADEL` users can bypass email/phone verification via the UpdateHumanUser API (CVE-2026-27946). This impacts account integrity. Monitor for official patches. #ZITADEL #AuthBypass #Infosec https://www.pulsepatch.io/posts/cve-2026-27946-zitadel-self-verification-bypass
Post summary
ZITADEL's UpdateHumanUser API can bypass email/phone verification, threatening account integrity; users should monitor for official patches.
CVE-2026-27946: ZITADEL Authorization Bypass: Self-Verification of Email and Phone A high-severity authorization bypass vulnerability in ZITADEL allows authenticated users to self-verify their email addresses and phone numbers via the V2 User API. By ... https://cvereports.com/reports/CVE-2026-27946
Post summary
The post announces a high‑severity authorization bypass in ZITADEL, where authenticated users can self‑verify email addresses and phone numbers through the V2 User API.
CVE-2026-27946 ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to m… https://www.cve.org/CVERecord?id=CVE-2026-27946
Post summary
The text announces a vulnerability in Zitadel’s self‑management feature, noting affected versions but providing no further technical details or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zitadel | zitadel | - | - | - |