Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62967— ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser

Quick assessment

Affected
sinamics ztnet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZTNET 是一个面向私有控制器的 ZeroTier Web 界面，支持多用户及组织管理功能。在 0.8.0 版本之前，任何经过身份验证的低权限用户均可通过 接口永久禁用其他账户（包括管理员账户）。在 文件中， 仅验证会话是否存在，却未将 与客户端提供的 进行比对。攻击者只需提供目标用户的 以及一个在 表中不存在匹配记录的 ，即可触发处理程序将目标账户的 字段设置为 false。随后， 会以“账户已过期（account-expired）”为由拒绝该用户的登录请求。攻击者仅需一个普通的已认证账户以及目标用户的 ID

CVSS 8.1 · High

Possible ATT&CK Techniques 2 AI

T1003 · OS Credential Dumping T1551
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62967

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
Source: CVE Program / CVE List V5
Vulnerability Description
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/invalidateUser`. In `src/pages/api/auth/user/invalidateUser.ts`, `getServerSession` checks only that a session exists and does not compare `session.user.id` with the client-supplied `userId`. Supplying a victim's `userId` and a `deviceId` for which no matching pair exists in `UserDevice` makes the handler set the target account's `isActive` to false. Login is then refused by `src/server/auth.ts` with `account-expired`. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sinamics ztnet < 0.8.0 -

II. Public POCs for CVE-2026-62967

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62967

请登录查看更多情报信息。

Other References for CVE-2026-62967 (4)

IV. Related Vulnerabilities

Same weakness: CWE-862