Loading story…
A high-severity authorization flaw tracked as CVE-2026-54693 allowed authenticated users of the ZITADEL identity management platform to obtain plaintext one-time verification codes during self-service profile changes. The bug affected backend authorization logic for email, phone, and human profile update paths, where multiple endpoints incorrectly hardcoded the allowSelfManagement permission flag to true. By sending profile update requests with the administrative returnCode parameter enabled, a user could receive the verification OTP directly in the JSON response instead of being required to control the target email address or phone number.
The vulnerability affects ZITADEL versions 2.43.0 through 2.71.19, 3.0.0-rc.1 through before 3.4.11, and 4.0.0-rc.1 through before 4.15.1. Security researchers said the flaw could let attackers claim ownership of email addresses or phone numbers they do not control and bypass email- or phone-based security policies. The issue is classified as CWE-863 Incorrect Authorization, is remotely exploitable, and carries a CVSS 4.0 score of 8.2. ZITADEL fixed the issue by changing the permission logic so allowSelfManagement is set dynamically to false whenever returnCode is true, with patched releases available in 3.4.11 and 4.15.1.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
ZITADEL released patched versions 3.4.11 and 4.15.1 for CVE-2026-54693. The fix changed authorization handling so self-management is no longer allowed when the administrative returnCode parameter is used.
A GitHub security advisory was published for CVE-2026-54693, describing an authorization flaw in ZITADEL that exposed verification codes during self-management API flows and could enable unauthorized email or phone ownership claims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ZITADEL, an identity and access management platform, has been found to contain critical vulnerabilities, including CVE-2025-67494 (CVSS 9.3) and CVE-2025-67495, that expose users to significant security risks. The flaws allow for server-side request forgery (SSRF), internal breaches, and account hijacking through DOM-based cross-site scripting (XSS) in the Zitadel V2 login interface. Successful exploitation could enable attackers to compromise user accounts and potentially gain unauthorized access to internal resources. Security advisories highlight the severity of these issues, urging organizations using ZITADEL to apply patches and mitigations immediately. The vulnerabilities underscore the importance of robust input validation and prompt security updates in identity management solutions to prevent exploitation and protect sensitive authentication infrastructure.
Jun 29, 2026
Zimbra disclosed security updates for Zimbra Collaboration Suite (ZCS) Daffodil releases before `10.1.21`, addressing vulnerabilities that include **CVE-2026-93643**, a critical unauthenticated path-traversal flaw in the OnlyOffice/Document Editing integration. An attacker able to access an existing supported public Briefcase document can abuse unsigned save fields in a `/downloadas` request to write files through path traversal and execute commands as the `zimbra` user; the flaw is rated CVSS 9.8. Canadian and Guyanese national cyber authorities urged administrators to review Zimbra’s release information and apply the available update. Two additional unauthenticated stored XSS vulnerabilities, **CVE-2026-93642** and **CVE-2026-93647**, can let attackers execute script in authenticated users’ browsers and access mailbox data or act as those users. The first uses a forged share invitation accepted in Zimbra Modern, while the second embeds active markup in the `From` field of a calendar `COUNTER` message viewed in the Classic client. Rapid7 warned that weaknesses across Zimbra mail, document, and calendar functions can support business email compromise campaigns that manipulate the records employees use for decisions, creating coordinated fraudulent communications and complicating forensic investigation.
Sep 29, 2026
Dutch authorities warned that attackers are actively exploiting **CVE-2024-45519** in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction. Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.
Sep 3, 2026