PT-2026-22071 · Zitadel · Zitadel

Livio-A · Published 2026-02-26 · Updated 2026-03-30 · CVE-2026-27946

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 3.4.7 ZITADEL versions prior to 4.11.1

Description ZITADEL, an open source identity management platform, had a flaw in its self-management feature. This allowed users to falsely mark their email and phone as verified without completing the verification process. The issue was addressed by enforcing proper permission checks when setting the verification flag and restricting self-management to the email address and/or phone number itself.

Recommendations Upgrade to ZITADEL version 3.4.7 or later. Upgrade to ZITADEL version 4.11.1 or later. If an upgrade is not possible, utilize an action (v2) to prevent setting the verification flag on user accounts.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27946

GHSA-282G-FHMX-XF54

GO-2026-4572

SUSE-SU-2026:1042-1

Affected Products

Zitadel

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27946.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27946 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27946 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-282g-fhmx-xf54 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.7 · Note
• https://github.com/zitadel/zitadel/commit/0261536243e500dccfd8c7f547d592c822478327 · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.11.1 · Note
• https://suse.com/security/cve/CVE-2026-29195 · Note
• https://suse.com/security/cve/CVE-2026-30851 · Note
• https://suse.com/security/cve/CVE-2026-27965 · Note
• https://suse.com/security/cve/CVE-2026-31961 · Note