zrok CVE-2026-40304
MEDIUM
GHSA-3jpj-v3xr-5h6g
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
AC:H reflects mandatory out-of-band token acquisition; PR:L for required account; A:H for platform-wide share disruption; C:N and I:N confirmed by description.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Summary The unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it.
Attack Vector: Network - the endpoint is a standard HTTP API call.
Attack Complexity: High - successful exploitation requires prior knowledge of a global frontend token. These tokens are not returned to non-admin users by any standard API endpoint; obtaining one requires an out-of-band step (e.g., leaked server logs, admin documentation for a self-hosted instance, or social engineering).
Privileges Required: Low - a valid user account with at least one registered environment is required; no admin privileges needed.
User Interaction: None.
Scope: Unchanged - the impact stays within the same server instance.
Confidentiality Impact: None - no data is disclosed.
Integrity Impact: None - no data is improperly modified; the record is deleted (not corrupted).
Availability Impact: High - deleting a global frontend disrupts every public share routed through it on the instance, constituting a platform-wide availability impact.
Affected Component controller/unaccess.go - unaccessHandler.Handle (line 56)
AnalysisAI
Broken ownership check in zrok's DELETE /api/v2/unaccess endpoint allows a low-privileged authenticated user to permanently delete admin-created global frontend records, taking down all public shares routed through that frontend on the affected instance. The flaw exists in controller/unaccess.go (unaccessHandler.Handle, line 56): when a frontend's environment_id is NULL - the marker for admin-created global frontends - the ownership guard short-circuits to false and skips authorization entirely. Exploitation requires prior knowledge of a global frontend token obtained out-of-band; no active exploitation is confirmed (not in CISA KEV), and EPSS is 0.04% at the 11th percentile, indicating low real-world exploitation probability at time of analysis.
Technical ContextAI
zrok is an open-source secure tunneling and public-sharing platform built on OpenZiti. Affected packages are pkg:go/github.com_openziti_zrok (v1 branch, <= 1.1.11) and pkg:go/github.com_openziti_zrok_v2 (v2 branch, < 2.0.1). The root cause is CWE-284 (Improper Access Control): the unaccessHandler in controller/unaccess.go performs an ownership check by comparing the frontend's environment_id against the requesting user's environment. When environment_id is NULL - the sentinel value for admin-created global frontends - the comparison evaluates to false and the guard logic incorrectly interprets this as 'ownership verified,' proceeding with the deletion without any further check. This is a classic null-dereference in an authorization guard rather than a missing check altogether. The vulnerable API endpoint is DELETE /api/v2/unaccess, a standard authenticated HTTP API call. Global frontends serve as routing hubs for public shares, so their deletion has cascading availability impact across all shares on the instance.
RemediationAI
For zrok v2 deployments, upgrade to v2.0.1 or later, which contains the confirmed security hardening for the /unaccess endpoint (https://github.com/openziti/zrok/releases/tag/v2.0.1). For zrok v1 (<=1.1.11), no v1-branch patch is indicated in the advisory; operators should migrate to the v2 branch or implement compensating controls: restrict network-layer access to the DELETE /api/v2/unaccess endpoint via a reverse proxy or API gateway that enforces admin-only authorization, noting this introduces an additional network component requiring maintenance. Alternatively, audit and rotate global frontend tokens if there is any suspicion of unauthorized disclosure. Advisory: https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today