Zipline Authorization Bypass Exposes Superadmin Secrets

Executive Summary

CVE-2026-126941 is a privilege escalation and authorization bypass flaw in Zipline through version 4.6.2. It allows authenticated administrators to read superadmin secrets due to missing role checks on GET /api/users and GET /api/users/:id endpoints. Attackers can retrieve plaintext TOTP secrets and OAuth tokens to bypass 2FA and take over superadmin accounts. Any authenticated user can also enumerate other users' folders via GET /api/user/folders.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to sensitive endpoints like GET /api/users, GET /api/users/:id, and GET /api/user/folders. Monitor logs for unusual requests to these paths, especially from non-admin users. Verify if plaintext TOTP secrets or OAuth tokens are exposed in responses.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator or user of Zipline <= 4.6.2, attackers could exploit this to steal sensitive data like 2FA secrets or OAuth tokens, leading to account takeovers. Even non-admin users can access other users' folder data. The impact includes unauthorized access, data breaches, and potential full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules. Exposure of plaintext secrets and user data may result in non-compliance, legal penalties, and reputational damage due to breaches of confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the vulnerable endpoints by enforcing role checks. Update the application to enforce the canInteract check on GET /api/users and GET /api/users/:id. Patch the logic bug in GET /api/user/folders to use the correct userId parameter. Consider disabling affected features until a fix is available.

Useful 0 Not Useful 0