PT-2026-33380 · Zrok · Zrok

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40304

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions zrok versions prior to 2.0.1

Description A logical error exists in the ownership guard of the unaccess handler within the controller/unaccess.go file. When a frontend record has the environment id variable set to NULL, which identifies admin-created global frontends, the verification condition short-circuits to false. This allows the deletion process to proceed without ownership verification. A non-admin user possessing a global frontend token can use the 'DELETE /api/v2/unaccess' endpoint with any of their own environment IDs to permanently delete the global frontend, resulting in the disruption of all public shares routed through it.

Recommendations Update to version 2.0.1.

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2026-40304

GHSA-3JPJ-V3XR-5H6G

Affected Products

Zrok

References · 7

• https://github.com/openziti/zrok/security/advisories/GHSA-3jpj-v3xr-5h6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40304 · Security Note
• https://osv.dev/vulnerability/GHSA-3jpj-v3xr-5h6g · Vendor Advisory
• https://github.com/openziti/zrok · Note
• https://github.com/openziti/zrok/releases/tag/v2.0.1 · Note
• https://twitter.com/dailycve/status/2044931736954450075 · Twitter Post
• https://twitter.com/CVEnew/status/2045467389114851662 · Twitter Post