CVE-2026-40304

Katalog CVE

CVSS 5.3 · Medium EPSS 0,36%

Kerentanan Improper Access Control pada netfoundry zrok. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g advisory vendor
• https://github.com/openziti/zrok/releases/tag/v2.0.1 release notes