A flaw in Zitadel’s self‑management API allows any user to mark their own email or phone number as verified without completing the intended verification process. This circumvents the normal authentication flow and grants the user the full set of privileges that normally require a verified contact, enabling potential credential reuse and phishing avoidance. The vulnerability stems from missing authorization checks (CWE‑862).

The issue affects the open‑source Zitadel identity platform, specifically all releases prior to version 4.11.1 and 3.4.7. Users running those earlier versions are at risk, while the patched releases enforce permission checks and restrict self‑management of the verification flag.

The CVSS score of 8.2 denotes high severity, but the EPSS probability is less than 1%, indicating currently low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending an UpdateHumanUser request with a verification flag, likely from a compromised or newly created account. Because the verification status can be faked, attackers could evade multi‑factor authentication or other verification‑dependent controls. Given the low probability of widespread exploitation, monitoring and timely patching remain critical.