Headplane allowed an authenticated OIDC user to perform a path traversal and bypass RBAC checks when executing node or user rename or expiration operations. The vulnerability—identified as CWE‑22 and CWE‑285—enables the attacker to modify or churn any node or user record in Headscale. This change directly alters the integrity of the system’s node and user configuration, exposing the environment to unauthorized data changes.

Tale:Headplane, all releases before 0.6.3 and before 0.7.0‑beta.3.

The flaw is exploitable only by users who have already authenticated via OIDC; no additional privileges are required beyond normal user access. The CVSS score of 8.1 signals high severity. The EPSS score is unavailable, and the vulnerability is not included in the CISA KEV catalog. Patching removes the path traversal logic in the Headscale API client and restores proper authorization for rename and expiration operations.