zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openziti | zrok | before 2.0.1 | 2.0.1 | Patch available | CNA |
| — | github.com/openziti/zrok (Go) | up to 1.1.11 | — | No fix listed | GHSA-3jpj-v3xr-5h6g |
| — | github.com/openziti/zrok/v2 (Go) | before 2.0.1 | 2.0.1 | Patch available | GHSA-3jpj-v3xr-5h6g |
- zrok Vendoropenziti Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
- github.com/openziti/zrok (Go) Vendor— Affected up to 1.1.11 Fixed in — No fix listed GHSA-3jpj-v3xr-5h6g
- github.com/openziti/zrok/v2 (Go) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-3jpj-v3xr-5h6g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:* | before 2.0.1 | Vulnerable | Netfoundry |
- cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:* Versions before 2.0.1 Vulnerable ·Netfoundry
Remediation
- Fix · CNA zrok (openziti) Fixed in 2.0.1
- Fix · GHSA-3jpj-v3xr-5h6g github.com/openziti/zrok/v2 (Go) Fixed in 2.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40304
- 2026-10-03 Alias added: GHSA-3jpj-v3xr-5h6g
References
More openziti vulnerabilities
- TI-2026-33317 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CVSS 4.0CRITICAL 9.9
- TI-2025-20335 Cross Site Scripting potential in Ziti Console CVSS 3.1HIGH 8.2
- TI-2026-41883 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation CVSS 4.0HIGH 8.7
- TI-2026-30586 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CVSS 3.1HIGH 8.7
- TI-2026-29081 zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVSS 3.1HIGH 7.5
- TI-2026-33325 zrok copy writes attacker-controlled WebDAV paths outside the destination root CVSS 4.0HIGH 8.3
Sources
- CVE-2026-40304 · CVE Program
- CVE-2026-40304 · NVD
- FIRST EPSS
- GHSA-3jpj-v3xr-5h6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences