{"id":"EUVD-2026-23551","enisaUuid":"94713f2e-ac82-379d-8ad5-16c19cb0d47e","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id \u003d NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 9:04:23 PM","dateUpdated":"Apr 20, 2026, 2:57:24 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","aliases":"CVE-2026-40304\nGHSA-3jpj-v3xr-5h6g\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"b70ef6be-9b17-3038-96f3-5d27bff947c1","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"enisaIdVendor":[{"id":"65a05495-9aa8-3081-a303-76d00f438d30","vendor":{"name":"openziti"}}],"enisaIdVulnerability":[{"id":"8fdb4eb9-9133-3d29-a1bb-9affa8b8b4e8","vulnerability":{"id":"GHSA-3jpj-v3xr-5h6g","description":"zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records","datePublished":"Apr 16, 2026, 9:09:23 PM","dateUpdated":"Apr 24, 2026, 8:49:03 PM","baseScore":0.0,"references":"https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40304\nhttps://github.com/openziti/zrok\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23551\n","aliases":"CVE-2026-40304\nGHSA-3jpj-v3xr-5h6g\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ce5e8951-e63d-35bf-91da-3957c9eda8c0","vulnerability":{"id":"CVE-2026-40304","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id \u003d NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 9:04:23 PM","dateUpdated":"Apr 20, 2026, 2:57:24 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23551\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Oct 30, 2026, 7:16:35 AM","vulnerabilityProduct":[{"id":"052f3c18-20ba-3cf9-911b-7208b1e124ec","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"vulnerabilityVendor":[{"id":"bfd0e7b7-8d74-301c-b6a0-6b0c2590c2d3","vendor":{"name":"openziti"}}]}}],"enisaIdAdvisory":[]}