CVE-2026-54693 Details
Description
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
A vulnerability exists in ZITADEL's self-management API for email and phone verification. Affected versions include ZITADEL 2.43.0 through 2.71.19, 3.0.0 until 3.4.10, and 4.0.0 until 4.15.0. The issue arises from improper permission checks in the email and phone self-management API paths, allowing users to request verification codes without the necessary authorization. This flaw enables users to claim ownership of email addresses or phone numbers they do not control, potentially bypassing security policies that rely on email or phone verification.
Users can upgrade to ZITADEL versions 4.15.1 or 3.4.11, both of which include the necessary permission checks to prevent unauthorized verification. ZITADEL 2.71.19 users should upgrade to version 3.4.11.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v3.4.11 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.1 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.0 (semver) >= 3.0.0, <= 3.4.10 (semver) >= 2.43.0, <= 2.71.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |