CVE-2026-27946: 
NixOS vulnerability analysis and mitigation

CVE-2026-27946 is a missing authorization vulnerability in ZITADEL, an open-source identity management platform, that allows authenticated users to mark their own email address and phone number as verified without completing an actual verification process via the UpdateHumanUser API. It affects versions 4.0.0–4.11.0 and 3.0.0–3.4.6 (v4.x/v3.x), as well as 2.43.0–2.71.19 (v2.x). The vulnerability was discovered by MhdAsfan during a security audit and disclosed on February 25, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Github Advisory).

The root cause is an improper permission check (CWE-862: Missing Authorization) in ZITADEL's user self-management API endpoint (UpdateHumanUser). When a user updates their own profile, the API failed to enforce the required privilege check before allowing the isEmailVerified or isPhoneVerified flag to be set to true, even though the same permission check was correctly applied when modifying another user's data. An attacker with a valid low-privileged account can craft an API request to the UpdateHumanUser endpoint, including the verification flag set to true, to bypass the email or phone verification workflow entirely. No special conditions or elevated privileges are required beyond having a valid user account on the affected ZITADEL instance (GitHub Advisory).

Successful exploitation allows a user to claim ownership of an email address or phone number they do not actually control, effectively bypassing email- and phone-based security policies enforced by ZITADEL. This can enable account takeover scenarios, identity spoofing, and unauthorized access to features or downstream applications that rely on verified contact information as a trust signal. There is no direct confidentiality or availability impact, but the high integrity impact on both the vulnerable and subsequent systems means that trust in the identity platform's verification state is fundamentally undermined (GitHub Advisory, Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.044% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain a valid account: Register or obtain credentials for a low-privileged user account on a vulnerable ZITADEL instance (versions 4.0.0–4.11.0, 3.0.0–3.4.6, or 2.43.0–2.71.19).
2. Authenticate and obtain a session token: Log in via the ZITADEL authentication flow to obtain a valid bearer token or session credential for the API.
3. Craft a malicious UpdateHumanUser API request: Construct an API call to the UpdateHumanUser endpoint targeting the attacker's own user ID, including the payload fields isEmailVerified: true and/or isPhoneVerified: true alongside an arbitrary email address or phone number.
4. Submit the request: Send the crafted request to the ZITADEL API (e.g., via PUT /v2/users/{userId}/human) with the bearer token in the Authorization header.
5. Verify the result: Confirm that the target email or phone is now marked as verified in the user profile without having received or responded to any verification code, effectively bypassing the verification workflow.
6. Leverage the verified status: Use the now-verified contact information to access features, bypass security policies, or perform actions in downstream applications that require verified email/phone as a prerequisite (GitHub Advisory).

• Logs: ZITADEL audit logs showing UpdateHumanUser API calls where the isEmailVerified or isPhoneVerified flag is set to true without a preceding verification code issuance or confirmation event for the same user.
• Logs: Absence of a verification email/SMS send event followed immediately by a verified status change in the user record — this sequence gap is anomalous.
• Network: API requests to the UpdateHumanUser endpoint (e.g., PUT /v2/users/{userId}/human) containing verification flag fields in the request body from user-level (non-admin) sessions.
• Application State: User accounts where email or phone verification status changed without a corresponding verification flow completion event in the event store.

ZITADEL has released patched versions addressing this vulnerability: upgrade to 4.11.1 (for v4.x), 3.4.7 (for v3.x), or 3.4.7 (for v2.x, as the v2.x line is remediated via the v3.4.7 patch). If an immediate upgrade is not possible, administrators should configure a ZITADEL action (v2) to intercept and block any attempt to set the verification flag on a user's own profile as a temporary workaround. For questions, contact the ZITADEL security team at security@zitadel.com (GitHub Advisory, Github Advisory).

The vulnerability was identified by security researcher MhdAsfan during a third-party security audit and responsibly disclosed to the ZITADEL team. ZITADEL published the advisory on February 25, 2026, with patches available on the same day. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.