CVE-2026-129466: Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it; the vulnerable endpoint does not require the monitor:job permission. The attacker needs a valid login but does not need user interaction or elevated privileges.
What information can an attacker retrieve?
An attacker can retrieve scheduled task details, including job parameters, API URLs, cron expressions, and stored SQL statements. Task IDs can be obtained from the unprotected /monitor/jobLog/list endpoint.
How can I determine whether my deployment is affected?
Deployments using commits from 1845017 through eb9228a are affected. Test whether a low-privileged authenticated account without monitor:job can request /system/Tasks/get for a task ID obtained through /monitor/jobLog/list.