CVE-2026-62967 — ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser

CIRCL Vulnerability-Lookup describes CVE-2026-62967 in ZTNET as a missing-authorization vulnerability (CWE-862). According to the title, any user can deactivate arbitrary accounts through the /api/auth/user/invalidateUser API endpoint.