Self-Management Flaw in ZITADEL Identity Management Platform

CVE-2026-27946

What is CVE-2026-27946?

ZITADEL's open-source identity management platform exhibited a critical self-management vulnerability that permitted users to mark their email and phone numbers as verified without completing the necessary verification process. This issue compromised user account integrity by inadequately managing verification flags. The vulnerability has been addressed in updates 4.11.1 and 3.4.7, where new permissions ensure that only authorized actions allow for self-verification of email addresses and phone numbers. Users unable to upgrade can implement a specific action (v2) to mitigate this issue by disabling the ability to set verification flags.

References