CVE-2026-27946

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.7 ZITADEL versions prior to 4.11.1

Description ZITADEL, an open source identity management platform, had a flaw in its self-management feature. This allowed users to falsely mark their email and phone as verified without completing the verification process. The issue was addressed by enforcing proper permission checks when setting the verification flag and restricting self-management to the email address and/or phone number itself.

Recommendations Upgrade to ZITADEL version 3.4.7 or later. Upgrade to ZITADEL version 4.11.1 or later. If an upgrade is not possible, utilize an action (v2) to prevent setting the verification flag on user accounts.