CVE-2026-40304: fallo de gravedad media en openziti zrok
zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
openziti · zrokCVEs relacionadas — openziti zrok
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-45568CRITICALzrok Python ProxyShare can be used as an SSRF proxy through absolute URL pathsEPSS 0.5%CVE-2026-45576HIGHzrok copy writes attacker-controlled WebDAV paths outside the destination rootEPSS 0.5%CVE-2026-40303HIGHzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingEPSS 0.5%CVE-2026-42275HIGHzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeEPSS 0.3%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%