CVE-2026-62967

Name of the Vulnerable Software and Affected Versions ZTNET versions prior to 0.8.0

Description An authenticated low-privilege user can permanently deactivate any other account, including those of administrators. This occurs via the POST /api/auth/user/invalidateUser endpoint. The issue resides in src/pages/api/auth/user/invalidateUser.ts, where the getServerSession function verifies the existence of a session but fails to compare the session.user.id with the provided userId variable. By supplying a victim's userId and a deviceId that does not have a matching pair in UserDevice, the handler sets the target account's isActive variable to false. Consequently, the src/server/auth.ts file refuses login attempts with an account-expired message. An attacker requires a standard authenticated account and the victim's user ID, which can be gathered from member lists, UI responses, logs, or application metadata.

Recommendations Update to version 0.8.0. Avoid using the userId parameter in the POST /api/auth/user/invalidateUser endpoint until the update is applied.