OpenZiti Zrok Global Frontend Deletion Vulnerability in Unaccess Handler

A logical error in the ownership verification of the unaccess handler in OpenZiti Zrok prior to version 2.0.1 allows non-admin users to delete global frontend records. When a frontend record's environment_id is NULL, indicating it was created by an admin, the ownership check is bypassed. This flaw enables a non-admin user with knowledge of a global frontend token to delete the global frontend via the DELETE /api/v2/unaccess endpoint, disrupting all public shares routed through that frontend.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of global frontend records, which disrupts all public shares routed through the deleted frontend, causing a platform-wide availability impact.

Remediation

Users can upgrade to OpenZiti Zrok version 2.0.1 or later to address this vulnerability.