# CVE-2026-54693: ZITADEL incorrect authorization in email and phone self-management API

Source: https://junglewise.ai/threats/cve-2026-54693-zitadel-incorrect-authorization-in-email-and-phone-self  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54693 · Severity: high · CVSS 4 · Published 2026-07-29

ZITADEL, an identity management platform, contained a flaw that allowed users to verify their own email addresses or phone numbers without actually receiving a verification code. This could allow an attacker to claim ownership of contact information they do not control, potentially bypassing security policies that rely on verified identity. Organizations using ZITADEL for authentication should update to a patched version to ensure the integrity of user data.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-54693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54693 being exploited in the wild.

**How severe is CVE-2026-54693?** High severity, with a CVSS score of 4, published 29 July 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=4.0.0; ZITADEL 2.43.0 - 2.71.19, 3.0.0 - 3.4.10, 4.0.0 - 4.15.0, 2.43.0 to 2.71.19, 3.0.0 to 3.4.10, 4.0.0 to 4.15.0.

**Is there a fix for CVE-2026-54693?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54693 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54693?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) in ZITADEL's self-management API allowed authenticated users to retrieve their own email or phone verification codes. By exploiting improper permission checks, a user could update their profile and mark contact details as verified without completing the standard out-of-band verification flow. This bypasses security policies that depend on the 'is_verified' status of a user's email or phone. The issue is fixed in versions 4.15.1 and 3.4.11 (which also covers the 2.x branch). A workaround involves using ZITADEL Actions (v2) to block the API from returning verification codes to the user.

## Affected products

- ZITADEL ZITADEL 2.43.0 to 2.71.19, 3.0.0 to 3.4.10, 4.0.0 to 4.15.0

## Identifiers

- CVE-2026-54693
- GHSA-jq8w-8q2f-ffm9
- GO-2026-6141

## Timeline

- 2026-06-08: disclosed
- 2026-07-29: advisory

## References

- [https://api.github.com/users/IAM-marco](https://api.github.com/users/IAM-marco)
- [https://github.com/IAM-marco](https://github.com/IAM-marco)
- [https://api.github.com/users/IAM-marco/gists%7B/gist_id%7D](https://api.github.com/users/IAM-marco/gists%7B/gist_id%7D)
- [https://api.github.com/users/IAM-marco/repos](https://api.github.com/users/IAM-marco/repos)
- [https://avatars.githubusercontent.com/u/8115374?v=4](https://avatars.githubusercontent.com/u/8115374?v=4)
- [https://api.github.com/users/IAM-marco/events%7B/privacy%7D](https://api.github.com/users/IAM-marco/events%7B/privacy%7D)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)