Answer in brief
CVE-2026-54693 records a High severity security vulnerability in ZITADEL Users Can Self-Verify Email/Phone via API. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Answer in brief
CVE-2026-54693 records a High severity security vulnerability in ZITADEL Users Can Self-Verify Email/Phone via API. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Update github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54693 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/zitadel/zitadelgo | >=4.0.0,<4.15.1 | Not reported |
| github.com/zitadel/zitadelgo | >=2.43.0,<3.4.11 | Not reported |
| github.com/zitadel/zitadelgo | <1.80.0-v2.20.0.20260608144108-ed09b3df7f43 | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54693 records a High severity security vulnerability in ZITADEL Users Can Self-Verify Email/Phone via API. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/zitadel/zitadel, github.com/zitadel/zitadel, github.com/zitadel/zitadel.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54693 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/zitadel/zitadelgo | >=4.0.0,<4.15.1 | Not reported |
| github.com/zitadel/zitadelgo | >=2.43.0,<3.4.11 | Not reported |
| github.com/zitadel/zitadelgo | <1.80.0-v2.20.0.20260608144108-ed09b3df7f43 | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54693 records a High severity security vulnerability in ZITADEL Users Can Self-Verify Email/Phone via API. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/zitadel/zitadel, github.com/zitadel/zitadel, github.com/zitadel/zitadel.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While [`GHSA-282g-fhmx-xf54`](https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54) (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling `UpdateHumanUser` with `email.is_verified: true`, additional paths were discovered. ### Impact Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone. Due to an improper permission check, the API allowed returning the verification code for the email and phone to the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies. Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked. ### Affected Versions Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.15.0` (including RC versions) - **3.x**: `3.0.0` through `3.4.10` (including RC versions) - **2.x**: `2.43.0` through `2.71.19` ### Patches The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself. 4.x: Upgrade to >=[4.15.1](https://github.com/zitadel/zitadel/releases/tag/v4.15.1) 3.x: Update to >=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11) 2.x: Update to >=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11) ### Workarounds The recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent returning the verification code to the own user. ### Questions If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected]) ### Credits Thanks to [eddieran](https://github.com/eddieran) for reporting this vulnerability.
### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. While [`GHSA-282g-fhmx-xf54`](https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54) (CVE-2026-27946, "Users Can Self-Verify Email/Phone via UpdateHumanUser API") closed the path that let any authenticated user mark an arbitrary email or phone as verified on their own account by calling `UpdateHumanUser` with `email.is_verified: true`, additional paths were discovered. ### Impact Zitadel provides an API for managing users. The API also allows users to self-manage their own data including updating the email and phone. Due to an improper permission check, the API allowed returning the verification code for the email and phone to the own user. This allows users to claim ownership of an email or phone they do not control and potentially bypass email-based security policies. Note that when changing another user's email or phone, regardless of the verification flag, the permissions were correctly checked. ### Affected Versions Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.15.0` (including RC versions) - **3.x**: `3.0.0` through `3.4.10` (including RC versions) - **2.x**: `2.43.0` through `2.71.19` ### Patches The vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address, resp. phone number itself. 4.x: Upgrade to >=[4.15.1](https://github.com/zitadel/zitadel/releases/tag/v4.15.1) 3.x: Update to >=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11) 2.x: Update to >=[3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11) ### Workarounds The recommended solution is to upgrade to a patched version. If an upgrade is not possible, an action (v2) could be used to prevent returning the verification code to the own user. ### Questions If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected]) ### Credits Thanks to [eddieran](https://github.com/eddieran) for reporting this vulnerability.