Authenticated low‑privilege users can permanently deactivate any target account, including administrators, by sending a POST request to /api/auth/user/invalidateUser. The endpoint accepts a victim’s userId and any deviceId that does not match a stored pair, causing the target account’s isActive flag to be set to false. When the account is deactivated, login attempts fail with an account‑expired error, effectively locking the user out. This flaw allows an attacker to impair critical organizational users, disrupt management, and deny service to the target account. The weakness corresponds to Missing Access Control (CWE‑862).

The vulnerability exists in the sinamics:Ztnet product in versions prior to 0.8.0. Users running any older release of ZTNET are susceptible if they have authenticated access.

Because the flaw is triggered by a standard authenticated session and requires only the victim’s user ID—which can be discovered from user lists or logs—an attacker can easily execute the privilege bypass. The CVSS score of 8.1 indicates high severity, while the absence of an EPSS score and a non‑KEV listing suggests that, at this time, the vulnerability has not yet been widely exploited, but its impact could still be significant in environments with many users if an attacker gains a low‑privilege account. The exploit would permanently deactivate target accounts, leading to lockouts for administrators and disrupting organization functionality.