CVE-2026-129454: Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint

Q: Who can exploit this issue?

Any authenticated user with low privileges can exploit it. No additional privileges or user interaction are required.

Q: What information could be exposed?

An attacker can read other users' workflow approval requests, including submitted form contents, applicant details, and approval records.

Q: How is the vulnerability exploited?

The attacker sends requests to GET /workflow/instance/{instanceId} using other workflow instance IDs. Sequential instance IDs can be enumerated to retrieve records belonging to other users.

Q: Are unauthenticated users affected?

The available information indicates authentication is required. The issue affects authorization between logged-in users, allowing a user to access workflow instances they do not own.

Published Nov 15, 2026

Updated

Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.

Affected Software

1 affected component

ZR.Admin.NET ZR.Admin.NET>=85cff6a<=eb9228a

Event History

Nov 15, 2026

CVE Published

via MITRE·01:49 AM

Data Sourced

via MITRE·01:49 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with low privileges can exploit it. No additional privileges or user interaction are required.

What information could be exposed?

An attacker can read other users' workflow approval requests, including submitted form contents, applicant details, and approval records.

How is the vulnerability exploited?

The attacker sends requests to GET /workflow/instance/{instanceId} using other workflow instance IDs. Sequential instance IDs can be enumerated to retrieve records belonging to other users.

Are unauthenticated users affected?

The available information indicates authentication is required. The issue affects authorization between logged-in users, allowing a user to access workflow instances they do not own.

CVE-2026-129454: Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

How is the vulnerability exploited?

Are unauthenticated users affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

How is the vulnerability exploited?

Are unauthenticated users affected?