CVE-2026-40304

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openziti/zrok/releases/tag/v2.0.1	Release Notes
https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versión 2.0.1, el gestor de desacceso (controller/unaccess.go) contiene un error lógico en su protección de propiedad: cuando un registro de frontend tiene environment_id = NULL (el marcador para frontends globales creados por administradores), la condición se cortocircuita a falso y permite que la eliminación proceda sin ninguna verificación de propiedad. Un usuario no administrador que conoce un token de frontend global puede llamar a DELETE /api/v2/unaccess con cualquiera de sus propios IDs de entorno y eliminar permanentemente el frontend global, derribando todas las comparticiones públicas enrutadas a través de él. La versión 2.0.1 parchea el problema.

Information

Published : 2026-04-17 22:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-40304

Mitre link : CVE-2026-40304

CVE.ORG link : CVE-2026-40304

JSON object : View

Products Affected

netfoundry

zrok

CWE

CWE-284

Improper Access Control

CWE-863

Incorrect Authorization

{"id": "CVE-2026-40304", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40304", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:51:35.879686Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openziti", "product": "zrok", "versions": [{"status": "affected", "version": "< 2.0.1"}]}]}], "published": "2026-04-17T22:16:32.230", "references": [{"url": "https://github.com/openziti/zrok/releases/tag/v2.0.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue."}, {"lang": "es", "value": "zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versi\u00f3n 2.0.1, el gestor de desacceso (controller/unaccess.go) contiene un error l\u00f3gico en su protecci\u00f3n de propiedad: cuando un registro de frontend tiene environment_id = NULL (el marcador para frontends globales creados por administradores), la condici\u00f3n se cortocircuita a falso y permite que la eliminaci\u00f3n proceda sin ninguna verificaci\u00f3n de propiedad. Un usuario no administrador que conoce un token de frontend global puede llamar a DELETE /api/v2/unaccess con cualquiera de sus propios IDs de entorno y eliminar permanentemente el frontend global, derribando todas las comparticiones p\u00fablicas enrutadas a trav\u00e9s de \u00e9l. La versi\u00f3n 2.0.1 parchea el problema."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70C6F018-6D34-4A75-A49D-A795B0A5B056", "versionEndExcluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}