ZR.ADMIN.NET · CVE-2026-129454 · Other
NO FIX YET · SEE WHAT TO DO
Zr.Admin.NET has an insecure direct object reference in its workflow instance endpoint, GET /workflow/instance/{instanceId}. A logged-in low-privilege user can enumerate sequential instance IDs and read other users' approval requests, form contents, applicant details and approval records.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of Zr.Admin.NET that include the commit range 85cff6a through eb9228a are exposed, with the workflow module in use. The attacker needs a valid login, but any authenticated user can reach the endpoint. Teams running later commits or not using the workflow module can skip it.
Not affected if auth-required, commit-after-eb9228a, no-workflow-module, workflow-module-unused
Who cares dotnet, idor, self-hosted, workflow, zr.admin.net
Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.