CVE-2026-40304 — zrok is software for sharing web services, files, and
Image via images.unsplash.com
CVE-2026-40304 — zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global front
What This Means For You
- If your environment is affected by CWE-284, CWE-863, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-40304 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
zrok Global Frontend Deletion via Unauthenticated API Call — CVE-2026-40304
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-40304 | vulnerability | CVE-2026-40304 |
| CWE-284 | weakness | CWE-284 |
| CWE-863 | weakness | CWE-863 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 18, 2026 at 01:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related Posts
ChurchCRM Flaw: Data Deletion Via CSRF
CVE-2026-40581 — ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of...
CVE-2026-40485 — ChurchCRM is an open-source church management system. In
CVE-2026-40485 — ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes...
ChurchCRM RCE: Unauthenticated Admin Exploit via Backup Restore
CVE-2026-40484 — ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies...