ETK-2026-4212Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4212",
  "cve_id": null,
  "display_id": "ETK-2026-4212",
  "ghsa_id": "GHSA-33f6-vcmh-2xfm",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization flaw in GPUStack resource ownership updates",
  "summary": "GPUStack versions 2.2.0 through 2.3.0 allow an authenticated user who can update an affected resource to alter its ownership or visibility. This can expose resources to other users and may let a non-administrator publish a GPU instance template globally; code in such a template runs only if another user chooses and launches it.",
  "mitigation": "Upgrade GPUStack to version 2.3.1. Review ownership assignments and globally visible templates for unexpected changes, and restrict resource updates to trusted users until the upgrade is complete.",
  "vendor": "pip",
  "product": "pip:gpustack",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.2.3",
        "< 2.3.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.3.1"
      ],
      "package_name": "gpustack",
      "purl": "pkg:pypi/gpustack"
    }
  ],
  "cwes": [
    269
  ],
  "cvss_score": 9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.634699816666668,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T16:22:15+00:00",
      "days": -0.20030448131944445,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T21:10:41.412365+00:00",
      "url": "https://github.com/gpustack/gpustack/security/advisories/GHSA-33f6-vcmh-2xfm"
    }
  }
}