Description
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
Published: 2026-07-29
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ZITADEL versions from 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1 expose the internal API paths used for email and phone self‑verification. The implementation lacks the required permission check, allowing any authenticated user to request verification codes and thereby claim ownership of addresses or numbers they do not control. This flaw maps to missing authorization (CWE-863).

Affected Systems

The vulnerability affects the open‑source Zitadel identity platform, specifically all releases listed above. Admins should check that they are not running any of these legacy versions and consider the affected ranges as a risk if in use.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity, while an EPSS score of < 1% suggests a low probability of observed exploitation. The vulnerability is not listed as a known exploited vulnerability by CISA (KEV). It is likely to be attacked via the exposed API by authenticated users who can trigger verification code requests without proper authorization; this inference is based on the description of the flaw.

Generated by OpenCVE AI on August 3, 2026 at 13:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch to move to Zitadel version 3.4.11 or 4.15.1 or later where the permission check has been reinstated.
  • Disable or restrict the email and phone self‑verification API endpoints until patching is complete, ensuring only authorized roles can invoke them.
  • Enable logging and audit trails for verification code requests to detect and respond to suspicious activity.

Generated by OpenCVE AI on August 3, 2026 at 13:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jq8w-8q2f-ffm9 ZITADEL Users Can Self-Verify Email/Phone via API
History

Wed, 29 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Zitadel
Zitadel zitadel
Vendors & Products Zitadel
Zitadel zitadel

Wed, 29 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
Title ZITADEL Users Can Self-Verify Email/Phone via API
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}

Subscriptions

Zitadel Zitadel
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-29T17:54:41.535Z

Reserved: 2026-06-15T22:58:06.562Z

Link: CVE-2026-54693

cve-icon Vulnrichment

Updated: 2026-07-29T17:54:36.321Z

cve-icon NVD

Status : Deferred

Published: 2026-07-29T17:16:53.067

Modified: 2026-07-30T20:07:01.330

Link: CVE-2026-54693

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:15:05Z

Weaknesses