---
id: "CVE-2026-126941"
page: "https://infrastack.ai/live/CVE-2026-126941"
kind: "vulnerability"
aliases: ["CVE-2026-126941"]
title: "Zipline: admin accounts can read superadmin 2FA secrets and OAuth tokens"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "zipline", "fixed": [], "affected": "<= 4.6.2", "ecosystem": "github"}]
ecosystems: []
tags: ["authorization-bypass", "package", "self-hosted", "zipline"]
not_affected_if: ["no-admin-accounts", "no-admin-users-besides-superadmin", "single-user-instance"]
published_at: "2026-11-13T10:18:01+00:00"
first_seen_at: "2026-11-13T10:47:27+00:00"
updated_at: "2026-11-13T10:53:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126941", "first_seen_at": "2026-11-13T10:47:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:53:11+00:00"}]
exploit_sources: []
---

# Zipline: admin accounts can read superadmin 2FA secrets and OAuth tokens

Link for people: https://infrastack.ai/live/CVE-2026-126941 (this .md is for agents)

Zipline through 4.6.2 has a missing authorization check on the user API endpoints GET /api/users and GET /api/users/:id. An authenticated administrator can read plaintext TOTP secrets and OAuth tokens of superadmin accounts, bypass two-factor authentication and take over those accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:zipline affected <= 4.6.2 fixed no fixed version listed

## How to check

Check the installed Zipline version; <=4.6.2 is affected. Review which accounts hold the ADMIN role. If an untrusted ADMIN existed, treat superadmin TOTP secrets and OAuth tokens as exposed. Also: any authenticated user can list other users' folders via GET /api/user/folders.

## Fix

No patched version published as of the GitHub advisory (patched versions: None). Until one ships, limit ADMIN role to fully trusted people; if an untrusted admin may have had access, reset superadmin TOTP and re-authorize OAuth tokens.

## Timeline

- 2026-11-13T10:47:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126941
- 2026-11-13T10:53:11+00:00 analyst — GHSA-8643-cr38-p6qj (maintainer): all versions <=4.6.2 affected, no patched version listed; default behaviour, no config needed. Also GET /api/user/folders lets any authenticated user list other users' folders. No exploitation or PoC seen.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-8643-cr38-p6qj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-through-4.6.2-privilege-escalation-via-missing-role-checks-on-user-endpoints

## From the sources

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_