CVE-2026-27946
Last modified
CVE-2026-27946 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zitadel | Zitadel | < 3.4.7 |
| Zitadel | Zitadel | >= 4.0.0, < 4.11.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27946?
How severe is CVE-2026-27946?
How do I fix CVE-2026-27946?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27940llama.cpp is an inference of several LLM models in C/C++. Pr…7.8
- CVE-2026-27941OpenLIT is an open source platform for AI engineering. Prior…9.9
- CVE-2026-27942fast-xml-parser allows users to validate XML, parse XML to J…7.5
- CVE-2026-27943OpenEMR is a free and open source electronic health records …6.5
- CVE-2026-27944Nginx UI is a web user interface for the Nginx web server. P…9.8
- CVE-2026-27945ZITADEL is an open source identity management platform. Zita…6.5
- CVE-2026-27947Group-Office is an enterprise customer relationship manageme…8.8
- CVE-2026-27948Copyparty is a portable file server. In versions prior to 1.…6.1
- CVE-2026-27949Plane is an an open-source project management tool. Prior to…4.3
- CVE-2026-2795Use-after-free in the JavaScript: GC component. This vulnera…9.8
- CVE-2026-27950FreeRDP is a free implementation of the Remote Desktop Proto…7.5
- CVE-2026-27951FreeRDP is a free implementation of the Remote Desktop Proto…7.5
Are you affected by CVE-2026-27946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST