The vulnerability in openziti zrok arises from a logical error in the ownership guard of the unaccess handler (controller/unaccess.go). Specifically, when a frontend record has environment_id set to NULL (indicating an admin-created global frontend), the condition that checks ownership short-circuits to false, allowing deletion without verifying if the requester is an admin. Consequently, a non-admin user who knows a global frontend token can invoke DELETE /api/v2/unaccess with any of their own environment IDs to delete the global frontend. This leads to denial of availability of all public shares dependent on that frontend. The vulnerability is fixed in version 2.0.1.

The vulnerability allows a non-admin user with knowledge of a global frontend token to delete that global frontend permanently. This results in denial of service for all public shares routed through the deleted frontend. There is no confidentiality or integrity impact reported. The CVSS score is 5.3 (medium severity), reflecting a network attack vector with high attack complexity and low privileges required, causing availability disruption.

Upgrade openziti zrok to version 2.0.1 or later, where this improper access control vulnerability is patched. Since no official vendor advisory or patch link is provided, verify the upgrade from the official openziti project sources. Until upgraded, restrict access to global frontend tokens and monitor for unauthorized DELETE /api/v2/unaccess requests if possible.