Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | >= 4.0.0, < 4.15.1 | |
| github.com/zitadel/zitadel | go | >= 2.43.0, < 3.4.11 |
Miggo AIRoot Cause AnalysisThe vulnerability allowed users to self-verify their email or phone number without actually performing the verification step. This was due to an improper permission check in several functions related to user data management. The core of the issue was that when a user requested a verification code to be returned directly to them via an API call (by setting returnCode to true), the system did not enforce the necessary write permissions, treating it as a self-management operation. This allowed a user to obtain the verification code for an email or phone number they did not own and then use it to mark the contact method as verified.
The patches address this by explicitly checking if returnCode is true. If it is, the allowSelfManagement flag is set to false, which in turn triggers a stricter permission check (checkPermissionUpdateUser). This ensures that only users with the appropriate write permissions can request the verification code to be returned, effectively preventing the self-verification vulnerability. The affected functions, changeUserEmailWithGeneratorEvents, sendUserEmailCodeWithGeneratorEvents, changeUserPhoneWithGenerator, resendUserPhoneCodeWithGenerator, and the parent function ChangeUserHuman, were all modified to incorporate this logic.
command.Commands.changeUserEmailWithGeneratorEventsinternal/command/user_v2_email.go
| github.com/zitadel/zitadel | go | < 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 | 1.80.0-v2.20.0.20260608144108-ed09b3df7f43 |
command.Commands.sendUserEmailCodeWithGeneratorEventsinternal/command/user_v2_email.go
command.Commands.changeUserPhoneWithGeneratorinternal/command/user_v2_phone.go
command.Commands.resendUserPhoneCodeWithGeneratorinternal/command/user_v2_phone.go
command.Commands.ChangeUserHumaninternal/command/user_v2_human.go