{"id":"CVE-2026-54693","aliases":["GHSA-jq8w-8q2f-ffm9","GO-2026-6141"],"url":"https://o3.security/vulnerability/CVE-2026-54693","summary":"ZITADEL Users Can Self-Verify Email/Phone via API","details":"ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.","published":"2026-07-29T16:50:39.957Z","modified":"2026-09-09T18:26:42.472796419Z","cvss":null,"epss":{"score":0.00343,"percentile":0.27483,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":null},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":null},{"ecosystem":"Go","name":"github.com/zitadel/zitadel","fixedVersion":"1.80.0-v2.20.0.20260608144108-ed09b3df7f43"}],"fix":{"url":"https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d","label":"zitadel/zitadel@90f3102"},"references":[{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v3.4.11"},{"type":"WEB","url":"https://github.com/zitadel/zitadel/releases/tag/v4.15.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54693.json"},{"type":"ADVISORY","url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54693"},{"type":"FIX","url":"https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d"},{"type":"FIX","url":"https://github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151"},{"type":"FIX","url":"https://github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-09T18:26:42.472796419Z"}}