User Deactivation Vulnerability in ZTNET by Sinamics

CVE-2026-62967

What is CVE-2026-62967?

The ZTNET web UI, developed by Sinamics, is susceptible to a vulnerability that allows low-privilege authenticated users to deactivate other accounts, including administrators. This issue arises from inadequate session validation in the invalidateUser API endpoint, where the system only checks for a session's existence without verifying if the user ID corresponds to the authenticated user. This design flaw can be exploited by attackers to disable targeted user accounts by supplying the respective user ID. Such an attack can lead to administrative lockouts and hinder organizational management. The problem has been fixed in version 0.8.0, highlighting the importance of keeping the platform updated.

References