ETK-2026-3768Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3768",
  "cve_id": null,
  "display_id": "ETK-2026-3768",
  "ghsa_id": "GHSA-qjgj-6fmg-c5c8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass in auth-framework GnapService",
  "summary": "auth-framework GnapService could issue access tokens for requested rights without an authorization-policy decision and did not consistently require client identification or validated interaction completion. An attacker could obtain tokens with requested access when an integrator exposed GnapService transaction handling to clients. The crate's built-in HTTP router does not serve these routes, so exposure depends on an integrator wiring the service into a client-facing endpoint.",
  "mitigation": "Upgrade auth-framework to 0.6.0-rc217 or 0.5.0-rc90. Until upgraded, do not expose GnapService to clients; enforce authentication and authorization before forwarding requests to it.",
  "vendor": "rust",
  "product": "rust:auth-framework",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.6.0-rc41, < 0.6.0-rc217"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "0.6.0-rc217"
      ],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.5.0-rc18, < 0.5.0-rc90"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "0.5.0-rc90"
      ],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 29.210821033333332,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T21:52:25+00:00",
      "days": -1.117999732800926,
      "is_lower_bound": true,
      "measured_at": "2026-11-08T00:42:20.214554+00:00",
      "url": "https://github.com/ciresnave/auth-framework/security/advisories/GHSA-qjgj-6fmg-c5c8"
    }
  }
}