{"id":"CVE-2026-62967","kind":"vulnerability","aliases":["CVE-2026-62967"],"related":[],"title":"ZTNET: any logged-in user can lock out other accounts, including admins","description":"ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/invalidateUser`. In `src/pages/api/auth/user/invalidateUser.ts`, `getServerSession` checks only that a session exists and does not compare `session.user.id` with the client-supplied `userId`. Supplying a victim's `userId` and a `deviceId` for which no matching pair exists in `UserDevice` makes the handler set the target account's `isActive` to false. Login is then refused by `src/server/auth.ts` with `account-expired`. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0.","summary":"ZTNET's account-invalidation endpoint does not check that the caller owns the user ID it deactivates. Any authenticated low-privilege user can permanently disable another account, including an administrator's, and that account is then refused login.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","zerotier","ztnet"],"not_affected_if":["single-user","version-0.8.0-or-later"],"how_to_check":"- Check the ZTNET version and confirm it is below `0.8.0`\n- Look for `src/pages/api/auth/user/invalidateUser.ts` in the deployed code and see whether it compares `session.user.id` with the request `userId`","fix":"- ZTNET: move to `0.8.0` or later","status":"open","published_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:39+00:00","updated_at":"2026-10-30T21:26:39+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T21:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- ZTNET: move to `0.8.0` or later","reach":"network","title":"ZTNET: any logged-in user can lock out other accounts, including admins","impact":"medium","summary":"ZTNET's account-invalidation endpoint does not check that the caller owns the user ID it deactivates. Any authenticated low-privilege user can permanently disable another account, including an administrator's, and that account is then refused login.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ztnet","zerotier","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"any user can lock out administrators and other accounts","analyst_note":"","how_to_check":"- Check the ZTNET version and confirm it is below `0.8.0`\n- Look for `src/pages/api/auth/user/invalidateUser.ts` in the deployed code and see whether it compares `session.user.id` with the request `userId`","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.8.0-or-later","single-user"],"who_is_affected":"Any team running a self-hosted ZTNET instance below 0.8.0 with more than one user account is exposed, because any logged-in account can disable others. Single-user instances where only the owner has an account have little practical exposure. Deployments already on 0.8.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4347,"output_tokens":508,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-62967':16A,19A '/api/auth/user/invalidateuser':99C '0.8.0':82C,206C 'access':195C 'account':11A,29B,54B,61B,93C,142C,155C,164C 'account-expir':154C 'account-invalid':28B 'admin':13A 'administr':57B,96C,188C 'anoth':53B,92C 'applic':183C 'attack':158C 'authent':45B,84C,163C 'caller':37B 'check':34B,103C 'client':117C 'client-suppli':116C 'compar':112C 'control':74C 'cve':14A,17A 'deactiv':43B,91C 'deni':194C 'deviceid':127C 'disabl':52B 'disrupt':190C 'endpoint':31B 'exist':108C,133C 'expir':156C 'fals':146C 'fix':203C 'getserversess':102C 'handler':138C 'host':23B 'id':41B,170C 'includ':12A,55B,94C 'invalid':30B 'isact':144C 'issu':201C 'list':177C 'lock':8A,187C 'log':4A,180C 'logged-in':3A 'login':65B,147C 'low':47B,86C 'low-privileg':46B,85C 'make':136C 'manag':192C 'match':131C 'may':172C 'member':176C 'metadata':184C 'multius':76C 'need':159C 'normal':162C 'obtain':174C 'organ':78C,191C 'own':38B 'packag':20B 'pair':132C 'perman':51B,90C 'post':98C 'prior':80C 'privat':73C 'privileg':48B,87C 'refus':64B,150C 'respons':179C 'self':22B 'self-host':21B 'session':107C 'session.user.id':113C 'set':139C 'src/pages/api/auth/user/invalidateuser.ts':101C 'src/server/auth.ts':152C 'suppli':118C,120C 'support':79C 'target':141C,198C 'ui':71C,178C 'user':6A,40B,49B,88C,169C,199C 'userdevic':135C 'userid':119C,124C 'version':205C 'victim':122C,167C 'web':70C 'zeroti':24B,69C 'ztnet':1A,25B,26B,66C","nicknames":[],"mitigations":[],"who_affected":"Any team running a self-hosted ZTNET instance below 0.8.0 with more than one user account is exposed, because any logged-in account can disable others. Single-user instances where only the owner has an account have little practical exposure. Deployments already on 0.8.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62967","severity":null,"published_at":"2026-10-30T21:17:15+00:00","modified_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}