← Vulnerability feed

Vulnerability record · CVE-2024-2035 · published 6 June 2024

CVE-2024-2035: Zenml missing authorization vulnerability

Zenml · Zenml

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

6.5 CVSS 3.1 Medium EPSS 0.63% · top 52.0% CWE-862 · Missing authorization
6.5CVSS 3.1 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3 Patch
https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c ExploitIssue TrackingPatchThird Party Advisory
https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3 Patch
https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c ExploitIssue TrackingPatchThird Party Advisory

Track CVE-2024-2035 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-2083Zenml vulnerabilityA directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit th…EPSS 37%8.8CVE-2024-4680Zenml insufficient session expiration vulnerabilityA vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expirat…EPSS 0.41%8.8CVE-2024-28424Zenml code injection vulnerabilityzenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. Th…EPSS 0.71%8.8CVE-2024-25723ZenML Server activate endpoint allows remote privilege escalationZenML Server before 0.46.7 exposes the /api/v1/users/{user_name_or_id}/activate REST endpoint, which grants access based on a valid username plus a n…EPSS 71%analysed7.8CVE-2025-8406Zenml path traversal vulnerabilityZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_director…EPSS 0.37%7.5CVE-2024-9340Zenml vulnerabilityA Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by …EPSS 0.95%6.1CVE-2024-5062Zenml cross-site scripting vulnerabilityA reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutra…EPSS 0.39%6.1CVE-2024-2383Zenml clickjacking vulnerabilityA clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame…EPSS 0.36%

Source: NIST National Vulnerability Database (record CVE-2024-2035), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.