ZTNET: Missing authorization allows deactivation of other user accounts
Summary
ZTNET, a web UI for ZeroTier private controllers, does not verify that the user ID supplied to the invalidateUser endpoint matches the logged-in session. Any authenticated low-privilege user can therefore set another account, including an administrator, to inactive. The affected account is then refused login with an account-expired error until it is reactivated.
Affected
- ZTNET versions before 0.8.0
- Exploitation requires a normal authenticated account and the victim's user ID
Fixed in
- Fixed in ZTNET 0.8.0 (the endpoint was removed in PR #941)
- Newer releases exist; the latest release is recommended
Workaround
- Unknown for unpatched systems beyond restricting access to the web UI to management networks or a VPN
Exploitation
- No known exploitation in the wild at the time of research
- No public proof-of-concept found in our research; this does not rule one out
- EPSS: 0.37 % (percentile 31)
Our recommendation
- Update ZTNET to the latest release; back up the database first, as the 0.8.0 release migrates authentication and users may need to log in again
- Restrict web UI access to management networks or a VPN
- Review user accounts and check for unexpected deactivated accounts, especially administrators, after patching
- Treat as high priority if the instance is internet-exposed or has many accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vqfc-cmp9-c33q github.com
- ZTNET v0.8.0 release github.com
- Fix commit 7966af6 github.com
- Pull request #941 github.com
- VulDB CVE-2026-62967 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:44.
Original description (NVD)
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/invalidateUser`. In `src/pages/api/auth/user/invalidateUser.ts`, `getServerSession` checks only that a session exists and does not compare `session.user.id` with the client-supplied `userId`. Supplying a victim's `userId` and a `deviceId` for which no matching pair exists in `UserDevice` makes the handler set the target account's `isActive` to false. Login is then refused by `src/server/auth.ts` with `account-expired`. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.