ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support.
CVE-2026-62967
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through POST /api/auth/user/invalidateUser. In src/pages/api/auth/user/invalidateUser.ts, getServerSession checks only that a session exists and does not compare session.user.id with the client-supplied userId. Supplying a victim's userId and a deviceId for which no matching pair exists in UserDevice makes the handler set the target account's isActive to false. Login is then refused by src/server/auth.ts with account-expired. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0.
Assessment
- CVSS
- 8.1 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 30 October 2026
- Last updated
- 5 November 2026
- Weakness
- CWE-862
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-62967