Zitadel's self-management API had a permission bypass vulnerability (CWE-863) that allowed authenticated users to self-verify email addresses and phone numbers by obtaining verification codes without proper authorization. Although prior fixes addressed the ability to mark arbitrary emails or phones as verified via the UpdateHumanUser API, this additional path allowed users to claim ownership of contact information they do not control, potentially bypassing email-based security policies. The vulnerability affects multiple major versions of Zitadel and has been remediated by enforcing correct permission checks and restricting self-management to the user's own email and phone only.

Exploiting this vulnerability allows a user to bypass email and phone verification controls by self-verifying contact information without actual ownership. This could undermine security policies relying on verified contact details, potentially leading to unauthorized account recovery or access scenarios. The impact is limited to the user's own account, as permission checks prevent modifying other users' contact verification status.

A fix is available and has been released in Zitadel versions 4.15.1 and 3.4.11 and later. Users should upgrade to these patched versions to resolve the vulnerability. If upgrading is not immediately possible, a workaround involves configuring an action (v2) to prevent returning verification codes to the user. No other mitigation steps are recommended beyond applying the official patch or workaround.