CVE-2026-40304

CVE-2026-40304 is a logical error in the zrok unaccess handler (prior to version 2.0.1) that allows unauthorized deletion of global frontend records. When a frontend is marked as admin-created by having a NULL environment_id value, the ownership verification check fails and permits non-admin users possessing a global frontend token to delete the resource using their own environment credentials. This vulnerability affects all zrok versions before 2.0.1 and enables attackers to disrupt public file and web service sharing infrastructure. The vulnerability has a CVSS 3.1 score of 5.3 (MEDIUM) with network-based attack vector, high complexity, and requires low privileges (authenticated user status). The primary impact is availability disruption, as exploitation results in permanent deletion of global frontends and takedown of all associated public shares. The attack requires some technical knowledge to identify vulnerable global frontend tokens and execute the malicious DELETE request. This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of active exploitation in the wild. The EPSS score of 0.000130000 indicates extremely low probability of exploitation relative to other CVEs, and the vulnerability remains inactive on public hot lists. Organizations using zrok should apply the available patch in version 2.0.1 as part of standard maintenance procedures.