ETK-2026-2430Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2430",
  "cve_id": null,
  "display_id": "ETK-2026-2430",
  "ghsa_id": "GHSA-7f9r-fjg9-gmfx",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Captured-value forgery in denext inline Server Actions",
  "summary": "@denext/denext inline Server Actions that depend on values captured from a Server Component are affected. An attacker able to invoke such an action may supply replacement values for those captures, potentially accessing or changing another user's data when the action trusts them for authorization.",
  "mitigation": "Upgrade @denext/denext to version 4.5.1. Until upgraded, derive identity and ownership checks from the server-side session within each action, or move affected actions to a module-level \"use server\" file.",
  "vendor": "other",
  "product": "other:@denext/denext",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.5.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "4.5.1"
      ],
      "package_name": "@denext/denext",
      "purl": null
    }
  ],
  "cwes": [
    345
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.2254586,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T18:46:32+00:00",
      "days": -1.734311917349537,
      "is_lower_bound": true,
      "measured_at": "2026-10-22T12:23:56.574388+00:00",
      "url": "https://github.com/Brainwires/denext/security/advisories/GHSA-7f9r-fjg9-gmfx"
    }
  }
}