{"id":"CVE-2026-126941","kind":"vulnerability","aliases":["CVE-2026-126941"],"related":[],"title":"Zipline: admin accounts can read superadmin 2FA secrets and OAuth tokens","description":"Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.","summary":"Zipline through 4.6.2 has a missing authorization check on the user API endpoints GET /api/users and GET /api/users/:id. An authenticated administrator can read plaintext TOTP secrets and OAuth tokens of superadmin accounts, bypass two-factor authentication and take over those accounts.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zipline","fixed":[],"affected":"<= 4.6.2","ecosystem":"github"}],"ecosystems":[],"tags":["authorization-bypass","package","self-hosted","zipline"],"not_affected_if":["no-admin-accounts","no-admin-users-besides-superadmin","single-user-instance"],"how_to_check":"Check the installed Zipline version; <=4.6.2 is affected. Review which accounts hold the ADMIN role. If an untrusted ADMIN existed, treat superadmin TOTP secrets and OAuth tokens as exposed. Also: any authenticated user can list other users' folders via GET /api/user/folders.","fix":"No patched version published as of the GitHub advisory (patched versions: None). Until one ships, limit ADMIN role to fully trusted people; if an untrusted admin may have had access, reset superadmin TOTP and re-authorize OAuth tokens.","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:52:19+00:00","updated_at":"2026-11-13T10:53:11+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T10:52:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zipline: admin accounts can read superadmin 2FA secrets and OAuth tokens","impact":"high","summary":"Zipline through 4.6.2 has a missing authorization check on the user API endpoints GET /api/users and GET /api/users/:id. An authenticated administrator can read plaintext TOTP secrets and OAuth tokens of superadmin accounts, bypass two-factor authentication and take over those accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker takes over superadmin accounts by stealing 2FA secrets and tokens.","analyst_note":"Confirm the fixed version and whether the flaw is in the default config, via the GitHub vendor advisory and the VulnCheck advisory linked in the sources.","how_to_check":"- Check the installed Zipline version; the sources say versions through `4.6.2` are affected.\n- Review whether any non-superadmin accounts hold the administrator role on the Zipline instance.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-users-besides-superadmin"],"who_is_affected":"Teams that self-host Zipline 4.6.2 or earlier with administrator accounts. The sources describe the flaw as needing an authenticated administrator, so instances with only trusted, superadmin-level accounts face less risk. The sources do not say whether the default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4636,"output_tokens":583,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the flaw is in the default config, via the GitHub vendor advisory and the VulnCheck advisory linked in the sources.","search":"'-126941':14A,17A '-2026':13A,16A '/api/user/folders':124C '/api/users':41B,44B,88C,91C '2fa':7A,107C '4.6.2':29B,72C 'account':3A,59B,69B,112C 'admin':2A 'administr':48B,81C 'allow':79C 'api':38B 'attack':97C 'authent':47B,64B,80C,115C 'author':20B,33B,75C 'authorization-bypass':19B 'bypass':21B,60B,76C,106C 'caninteract':95C 'check':34B,96C 'contain':73C 'cve':12A,15A 'endpoint':39B 'enumer':118C 'factor':63B 'folder':121C 'get':40B,43B,87C,90C,123C 'host':25B 'id':45B,92C 'lack':93C 'miss':32B 'oauth':10A,55B,103C 'packag':22B 'plaintext':51B,100C 'read':5A,50B,83C 'retriev':99C 'secret':8A,53B,85C 'self':24B 'self-host':23B 'superadmin':6A,58B,84C,111C 'take':66B,109C 'token':11A,56B,104C 'totp':52B 'totpsecret':101C 'two':62B 'two-factor':61B 'user':37B,116C,120C 'via':122C 'vulner':77C 'ziplin':1A,26B,27B,70C 'zipline':18A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zipline instances running 4.6.2 or earlier with at least one ADMIN account that is not a SUPERADMIN. An ADMIN can call GET /api/users or /api/users/:id and read a SUPERADMIN's plaintext TOTP secret and OAuth access/refresh tokens, bypassing 2FA and taking over the account. Instances where the only admin is the superadmin can largely skip the admin issue, though the folder listing bug affects any multi-user instance.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:53:11Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj","run_id":3864},"products":{"at":"2026-11-13T10:53:11Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj","run_id":3864},"how_to_check":{"at":"2026-11-13T10:53:11Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj","run_id":3864},"who_affected":{"at":"2026-11-13T10:53:11Z","by":"analyst","doc":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj","run_id":3864}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["authorizationbypass","high","package","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126941':14A,17A '-2026':13A,16A '2fa':7A 'account':3A 'admin':2A 'cve':12A,15A 'oauth':10A 'read':5A 'secret':8A 'superadmin':6A 'token':11A 'ziplin':1A 'zipline':18A","search_b":"'/api/users':41B,44B '4.6.2':29B 'account':59B,69B 'administr':48B 'api':38B 'authent':47B,64B 'author':20B,33B 'authorization-bypass':19B 'bypass':21B,60B 'check':34B 'endpoint':39B 'factor':63B 'get':40B,43B 'host':25B 'id':45B 'miss':32B 'oauth':55B 'packag':22B 'plaintext':51B 'read':50B 'secret':53B 'self':24B 'self-host':23B 'superadmin':58B 'take':66B 'token':56B 'totp':52B 'two':62B 'two-factor':61B 'user':37B 'ziplin':26B,27B","search_c":"'/api/user/folders':124C '/api/users':88C,91C '2fa':107C '4.6.2':72C 'account':112C 'administr':81C 'allow':79C 'attack':97C 'authent':80C,115C 'author':75C 'bypass':76C,106C 'caninteract':95C 'check':96C 'contain':73C 'enumer':118C 'folder':121C 'get':87C,90C,123C 'id':92C 'lack':93C 'oauth':103C 'plaintext':100C 'read':83C 'retriev':99C 'secret':85C 'superadmin':84C,111C 'take':109C 'token':104C 'totpsecret':101C 'user':116C,120C 'via':122C 'vulner':77C 'ziplin':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-26T03:09:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126941","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126941:3864","url":null,"severity":null,"published_at":"2026-11-13T10:53:11+00:00","modified_at":"2026-11-13T10:53:11+00:00","first_seen_at":"2026-11-13T10:53:11+00:00","fetched_at":"2026-11-13T10:53:11+00:00","note":"GHSA-8643-cr38-p6qj (maintainer): all versions <=4.6.2 affected, no patched version listed; default behaviour, no config needed. Also GET /api/user/folders lets any authenticated user list other users' folders. No exploitation or PoC seen."}],"documents":[{"id":145243,"url":"https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-06-26T03:09:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145244,"url":"https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}