GHSA-jq8w-8q2f-ffm9

Source

https://github.com/advisories/GHSA-jq8w-8q2f-ffm9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jq8w-8q2f-ffm9/GHSA-jq8w-8q2f-ffm9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jq8w-8q2f-ffm9

Aliases

Published

2026-07-29T16:54:49Z

Modified

2026-08-18T15:10:32Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

ZITADEL Users Can Self-Verify Email/Phone via API

Details

Summary

A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process.

While GHSA-282g-fhmx-xf54 (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling UpdateHumanUser with email.is_verified: true, additional paths were discovered.

Impact

Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone.

Due to an improper permission check, the API allowed returning the verification code for the email and phone to the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies.

Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked.

Affected Versions

Systems running one of the following versions are affected:

4.x: 4.0.0 through 4.15.0 (including RC versions)
3.x: 3.0.0 through 3.4.10 (including RC versions)
2.x: 2.43.0 through 2.71.19

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself.

4.x: Upgrade to >=4.15.1 3.x: Update to >=3.4.11 2.x: Update to >=3.4.11

Workarounds

The recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent returning the verification code to the own user.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to eddieran for reporting this vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-29T16:54:49Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Database specific

last_known_affected_version_range

"< 4.15.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jq8w-8q2f-ffm9/GHSA-jq8w-8q2f-ffm9.json"

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

2.43.0

Database specific

last_known_affected_version_range

"< 3.4.11"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jq8w-8q2f-ffm9/GHSA-jq8w-8q2f-ffm9.json"

Go / github.com/zitadel/zitadel

Package

Name: github.com/zitadel/zitadel; View open source insights on deps.dev
Purl: pkg:golang/github.com/zitadel/zitadel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.80.0-v2.20.0.20260608144108-ed09b3df7f43

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jq8w-8q2f-ffm9/GHSA-jq8w-8q2f-ffm9.json"