ZIPLINE · CVE-2026-126941 · Package
NO FIX YET · SEE WHAT TO DO
Zipline through 4.6.2 has a missing authorization check on the user API endpoints GET /api/users and GET /api/users/:id. An authenticated administrator can read plaintext TOTP secrets and OAuth tokens of superadmin accounts, bypass two-factor authentication and take over those accounts.
first public Jun 26, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline instances running 4.6.2 or earlier with at least one ADMIN account that is not a SUPERADMIN. An ADMIN can call GET /api/users or /api/users/:id and read a SUPERADMIN's plaintext TOTP secret and OAuth access/refresh tokens, bypassing 2FA and taking over the account. Instances where the only admin is the superadmin can largely skip the admin issue, though the folder listing bug affects any multi-user instance.
Not affected if no-admin-accounts, no-admin-users-besides-superadmin, single-user-instance
Who cares authorization-bypass, self-hosted, zipline
4.6.2 is affectedZipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.