Threats tagged 'ghsa-jq8w-8q2f-ffm9'

A vulnerability in Zitadel's user self-management API allowed users to mark their email and phone as verified without completing the actual verification process. This was due to improper permission checks that enabled users to retrieve verification codes for email and phone numbers they do not control. The issue affects Zitadel versions 4.0.0 through 4.15.0, 3.0.0 through 3.4.10, and 2.43.0 through 2.71.19. The vulnerability has been fixed in versions 4.15.1 and later, 3.4.11 and later, and 3.4.11 and later for the respective branches. Users are advised to upgrade to these patched versions to mitigate the risk. If upgrading is not possible, a workaround exists to prevent returning verification codes to the user.