{"id":"EUVD-2026-23551","revision":"6799bfcdcec24417b71117244c6fa00d","records":[{"revision":"6799bfcdcec24417b71117244c6fa00d","observedAt":"2026-11-01T06:16:18.178+00:00","statement":{"source":"euvd","id":"EUVD-2026-23551","aliases":["CVE-2026-40304","GHSA-3jpj-v3xr-5h6g"],"title":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL…","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.3,"severity":null}],"references":["https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g","https://github.com/openziti/zrok/releases/tag/v2.0.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23551","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 17, 2026, 9:04:23 PM","dateUpdated":"Apr 20, 2026, 2:57:24 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-23551","identifiers":["EUVD-2026-23551","CVE-2026-40304","GHSA-3jpj-v3xr-5h6g"]},"retained":false,"historicalAffected":[]}],"coverage":[]}