Ztnet
Monthly
ZTNET through 0.7.18 allows any authenticated low-privilege user to deactivate another account, including an administrator, by submitting a victim's userId together with a deviceId that has no matching UserDevice row to POST /api/auth/user/invalidateUser; the handler then sets isActive=false and the victim's login is refused with account-expired. The root cause is a missing authorization check (CWE-862) in a Next.js API route, so impact is confined to account availability and administrative disruption, with no confidentiality exposure or code execution. A public proof-of-concept procedure confirmed against v0.7.18 is published in the vendor advisory, and the issue is fixed in 0.8.0; no CISA KEV entry is associated with this CVE.
ZTNET through 0.7.18 allows any authenticated low-privilege user to deactivate another account, including an administrator, by submitting a victim's userId together with a deviceId that has no matching UserDevice row to POST /api/auth/user/invalidateUser; the handler then sets isActive=false and the victim's login is refused with account-expired. The root cause is a missing authorization check (CWE-862) in a Next.js API route, so impact is confined to account availability and administrative disruption, with no confidentiality exposure or code execution. A public proof-of-concept procedure confirmed against v0.7.18 is published in the vendor advisory, and the issue is fixed in 0.8.0; no CISA KEV entry is associated with this CVE.