PT-2026-65854 · Zitadel · Zitadel

CVE-2026-54693 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.43.0 through 2.71.19 ZITADEL versions 3.0.0 through 3.4.10 ZITADEL versions 4.0.0 through 4.15.0

Description An improper permission check in the self-management API allows authenticated users to request verification codes for emails and phone numbers without the necessary permissions. This flaw enables users to claim ownership of contact details they do not control, potentially bypassing security policies based on email or phone verification. The issue resides in the API paths handled by internal/command/user v2 email.go, internal/command/user v2 phone.go, and internal/command/user v2 human.go.

Recommendations Update ZITADEL versions 2.43.0 through 2.71.19 to version 3.4.11 or later. Update ZITADEL versions 3.0.0 through 3.4.10 to version 3.4.11 or later. Update ZITADEL versions 4.0.0 through 4.15.0 to version 4.15.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54693

GHSA-JQ8W-8Q2F-FFM9

Affected Products

Zitadel

References · 9

• https://osv.dev/vulnerability/GHSA-jq8w-8q2f-ffm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54693 · Security Note
• https://github.com/zitadel/zitadel/releases/tag/v4.15.1 · Note
• https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d · Note
• https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9 · Note
• https://github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f · Note
• https://github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.4.11 · Note
• https://github.com/zitadel/zitadel · Note