CVE-2026-54693 in Zitadel
Summary
by MITRE • 07/29/2026
ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-management API paths in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go allowed users to request returned verification codes without the required permission, allowing users to claim ownership of email addresses or phone numbers they do not control and bypass email-based or phone-based security policies. This issue is fixed in versions 3.4.11 and 4.15.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability identified in ZITADEL affects multiple version ranges including 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, representing a critical authorization flaw in the identity management platform's self-service capabilities. This issue stems from insufficient permission checks within the email and phone verification API endpoints located in internal/command/user_v2_email.go, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go files. The flaw allows unauthorized users to request verification codes for email addresses or phone numbers they do not control, effectively enabling privilege escalation through social engineering or brute force attacks.
The technical implementation of this vulnerability exposes a fundamental breakdown in the platform's access control mechanisms where the verification code request functionality lacks proper authentication and authorization checks. Attackers can exploit this weakness by simply calling the affected API endpoints with arbitrary email or phone number parameters, bypassing the normal user ownership validation processes that should prevent such unauthorized actions. This represents a clear violation of the principle of least privilege and demonstrates a critical flaw in the platform's permission model that allows users to impersonate other identities.
The operational impact of this vulnerability extends beyond simple privilege escalation as it fundamentally undermines the security posture of organizations relying on ZITADEL for identity management. Security policies that depend on email or phone verification as multi-factor authentication mechanisms become ineffective, allowing attackers to claim ownership of accounts and potentially gain unauthorized access to sensitive systems. The vulnerability also affects the integrity of user data since malicious actors can manipulate account associations and potentially disrupt legitimate user access. This issue directly relates to CWE-285 which addresses insufficient authorization checks and aligns with ATT&CK technique T1078.004 for valid accounts and privilege escalation through unauthorized system access.
Organizations using affected ZITADEL versions face significant risks including account takeover scenarios, potential data breaches, and compromised authentication systems where attackers can bypass security controls designed to protect user accounts. The vulnerability creates a pathway for attackers to validate email addresses or phone numbers they do not control, enabling them to circumvent security policies that should prevent unauthorized access attempts. This flaw particularly impacts the platform's ability to maintain secure user identity claims and undermines the trust model that identity management systems depend upon for effective security operations.
The remediation strategy requires immediate deployment of patched versions 3.4.11 and 4.15.1, which implement proper authorization checks within the affected API endpoints. Organizations should conduct thorough vulnerability assessments to identify any potential exploitation attempts and consider implementing additional monitoring controls around verification code request patterns. The fix addresses the root cause by ensuring that users can only request verification codes for addresses or numbers they legitimately own, thereby restoring proper access control boundaries. Security teams should also review their existing user management policies and consider implementing rate limiting measures to prevent abuse of the verification system while waiting for patch deployment.