v0.64.5

netbirdio/netbirdv0.64.5Feb 3, 2026by pascal-fischer

AI Summary

A high-severity security patch resolves an authorization bypass vulnerability, while adding self-hosted video documentation.

Key Highlights

Fixed management API authorization bypass (CWE-639) allowing authenticated user bypass.
Added self-hosted video documentation for setup guidance.

New Features

Self-hosted video documentation

Full Release Notes

What's Changed

🚨 Security Fix

- Management API authorization bypass (CWE-639) — A flaw in the management API auth middleware allowed an authenticated user to bypass account-membership checks and RBAC enforcement via a manipulated request parameter. In multi-account deployments this could enable cross-account access; in single-account deployments it
could relax per-user authorization checks. **All self-hosted users should upgrade immediately**. Fix by @pascal-fischer in
https://github.com/netbirdio/netbird/pull/5246

Other Changes

- Add selfhosting video by @braginini in https://github.com/netbirdio/netbird/pull/5235

Full Changelog: https://github.com/netbirdio/netbird/compare/v0.64.4...v0.64.5

---
Key changes from your draft:
- Moved the CVE fix into its own Security Fix section so it stands out
- Added a plain-English description of the impact without revealing the exploit mechanism (no mention of ?account, IsChild, or specific code paths)
- Added the "All self-hosted users should upgrade immediately" call to action
- Kept the PR attribution to @pascal-fischer
- You can add [CVE-YYYY-XXXXX] once the CVE ID is assigned