CVE-2026-27946
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceZITADEL versions prior to 4.11.1 and 3.4.7 contained a flaw in the self-management capability that allowed users to mark their email and phone as verified without completing actual verification. This verification bypass enables users to assert ownership of contact methods they do not control.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 3.4.7>= 4.0.0, < 4.11.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify ZITADEL versionCheck your installed ZITADEL instance version. This is typically available in the admin console, about page, or by querying the system version endpoint if exposed.Affected if The installed version is less than 3.4.7, or greater than or equal to 4.0.0 but less than 4.11.0 (or 4.11.1)
-
Verify self-management feature is in useDetermine whether users have access to self-service profile editing capabilities that allow them to modify their own contact information and verification status.Affected if Users have the ability to update their own email or phone through self-service, which is the default behavior in affected versions.
-
Review user contact verification flagsQuery user records to identify accounts where email_verified or phone_verified flags are set to true, particularly those that may have been self-assigned.Affected if Users have email_verified or phone_verified set to true without corresponding verification events or tokens in the system.
-
Check audit logs for verification bypassReview authentication and user audit logs for patterns where users marked themselves as verified without receiving verification emails or SMS codes.Affected if Logs show users with verified contact methods but no corresponding verification delivery records.
You are affected if your ZITADEL version falls below 3.4.7 or between 4.0.0 and 4.10.x inclusive, and users have used self-service to set their own email or phone as verified.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped3.4.74.11.0
Upgrade to ZITADEL versions 4.11.1 or 3.4.7 which enforce proper permission checks when verification flags are set, or implement a v2 custom action to block users from setting verification flags on their own accounts.
Zitadel 3.4.7 or Zitadel 4.11.1 (depending on your current major version branch)
- Identify your current Zitadel version using your deployment configuration or admin console
- For Zitadel 3.x versions: Upgrade to version 3.4.7
- For Zitadel 4.x versions (>=4.0.0): Upgrade to version 4.11.1
- After upgrade, verify that the /admin/v1/users/{id} endpoint now requires proper authorization when attempting to set email or phone as verified
- If immediate upgrade is not feasible, create a Zitadel v2 action that intercepts user update requests and prevents the 'isEmailVerified' or 'isPhoneVerified' flags from being set on the authenticated user's own profile
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-27946 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-27946 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data