CVE-2026-129465: Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile
Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it. The attacker does not need administrator privileges or user interaction.
What access is needed for administrator account takeover?
The attacker needs a valid authenticated account and must be able to receive SMS messages at a phone number they control. They can change the administrator's phone number through the profile update endpoint, request a code through /checkMobile, and authenticate through /PhoneLogin.
Which code revisions are affected?
The affected range is commit af07ffc through commit eb9228a.