CVE-2026-62967 - ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
CVE ID :CVE-2026-62967 Published : Oct. 30, 2026, 9:17 p.m. | 44 minutes ago Description :ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an...