Go/github.com/zitadel/zitadel CVE-2026-27946: medium 6.5, EPSS 0.22%

ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260225053417-0261536243e5 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260225053417-0261536243e5

Affected

Fixed versions

Sources

• osv: GO-2026-4572
• nvd: CVE-2026-27946
• https://github.com/zitadel/zitadel/security/advisories/GHSA-282g-fhmx-xf54
• https://github.com/zitadel/zitadel/commit/0261536243e500dccfd8c7f547d592c822478327
• https://github.com/zitadel/zitadel/releases/tag/v3.4.7
• https://github.com/zitadel/zitadel/releases/tag/v4.11.1

CVE-2026-27946 · published 2026-03-10T18:28:01Z · modified 2026-03-23T04:52:45.063724Z · JSON