CVE-2026-40304
Authorization Bypass in zrok Unaccess Handler Allows Deletion
Publication date: 2026-04-17
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netfoundry | zrok | to 2.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in zrok software versions prior to 2.0.1. It involves a logical error in the ownership guard of the unaccess handler. Specifically, when a frontend record has an environment_id set to NULL (indicating an admin-created global frontend), the condition meant to verify ownership incorrectly short-circuits to false. This flaw allows a non-admin user who knows a global frontend token to delete that global frontend by calling the DELETE /api/v2/unaccess endpoint with any of their own environment IDs, bypassing ownership verification.
As a result, the global frontend can be permanently deleted, which affects all public shares routed through it. The issue was fixed in version 2.0.1.
How can this vulnerability impact me? :
The vulnerability allows a non-admin user to delete a global frontend without proper authorization. This can lead to the permanent removal of the global frontend, causing all public shares that rely on it to become unavailable.
- Denial of service for users relying on public shares through the affected global frontend.
- Potential disruption of business operations or services that depend on these public shares.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade zrok to version 2.0.1 or later, as this version patches the logical error allowing unauthorized deletion of global frontends.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.