Auth bypass in Zitadel
CVE-2026-27946
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Vulnerability class: Broken Access Control
EPSS: 0.002 (7.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Zitadel — versions >= 4.0.0, < 4.11.0, < 3.4.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-27946?
- CVE-2026-27946 is a medium-severity vulnerability in Zitadel, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-02-26.
- How severe is CVE-2026-27946?
- Medium severity. CVSS v3 base score is 6.5 out of 10.