{"id":"CVE-2026-129454","kind":"vulnerability","aliases":["CVE-2026-129454"],"related":[],"title":"Zr.Admin.NET: logged-in users can read other users' workflow instances (no fix yet)","description":"Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.","summary":"Zr.Admin.NET has an insecure direct object reference in its workflow instance endpoint, GET /workflow/instance/{instanceId}. A logged-in low-privilege user can enumerate sequential instance IDs and read other users' approval requests, form contents, applicant details and approval records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zr.Admin.NET","fixed":[],"affected":">= 85cff6ae22389c241d3a4efe178273966650f7ca, <= eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","ecosystem":"github"}],"ecosystems":[],"tags":["dotnet","idor","other","self-hosted","workflow","zr.admin.net"],"not_affected_if":["auth-required","commit-after-eb9228a","no-workflow-module","workflow-module-unused"],"how_to_check":"Affected range per VulnCheck: Zr.Admin.NET commits 85cff6ae22389c241d3a4efe178273966650f7ca through eb9228a23014f6000c06cab2f10ae0d44ecbbd3a. Check your checkout with git log. Then read ZR.Workflow/Controllers/WfFlowInstanceController.cs and ZR.Workflow/Service/WfFlowInstanceService.cs for GET /workflow/instance/{instanceId}, and see whether it checks that the caller owns or may view the instance.","fix":"No fix published as of 2026-11-15: upstream issue #27 is open. Commit 85cff6a is where the affected range starts, not a fix. Until a fix lands, add an ownership/permission check in WfFlowInstanceService (GET /workflow/instance/{instanceId}) or restrict the route.","status":"open","published_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:27+00:00","updated_at":"2026-11-15T02:36:48+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-15T02:36:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zr.Admin.NET: logged-in users can read other users' workflow instances","impact":"medium","summary":"Zr.Admin.NET has an insecure direct object reference in its workflow instance endpoint, GET /workflow/instance/{instanceId}. A logged-in low-privilege user can enumerate sequential instance IDs and read other users' approval requests, form contents, applicant details and approval records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zr.admin.net","dotnet","workflow","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read other users' approval records and form data.","analyst_note":"Confirm the fixed commit or release from the linked patch on github.com and check the vulncheck advisory for the authorization fix details.","how_to_check":"- Check whether your deployment includes Zr.Admin.NET commits between 85cff6a and eb9228a (the range given in the advisory)\n- Look for the route `GET /workflow/instance/{instanceId}` in the codebase and check whether it verifies that the requester owns or may view the instance\n- unknown whether a version-based check is available","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["commit-after-eb9228a","workflow-module-unused"],"who_is_affected":"Deployments of Zr.Admin.NET that include the commit range 85cff6a through eb9228a are exposed, with the workflow module in use. The attacker needs a valid login, but any authenticated user can reach the endpoint. Teams running later commits or not using the workflow module can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4624,"output_tokens":618,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed commit or release from the linked patch on github.com and check the vulncheck advisory for the authorization fix details.","search":"'-129454':17A,20A '-2026':16A,19A '/workflow/instance':43B,86C '85cff6a':73C 'applic':66B,118C 'approv':62B,69B,112C,121C 'attack':102C 'authent':98C 'commit':72C,75C 'contain':77C 'content':65B,117C 'cve':15A,18A 'detail':67B,119C 'direct':34B,80C 'dotnet':22B 'eb9228a':76C 'endpoint':41B 'enumer':54B,104C 'fix':13A 'form':64B,116C 'get':42B,85C 'host':27B 'id':57B,107C 'idor':23B 'includ':114C 'insecur':33B,79C 'instanc':11A,40B,56B,97C,106C 'instanceid':44B,87C 'let':89C 'log':3A,47B,91C 'logged-in':2A,46B,90C 'low':50B,100C 'low-privileg':49B,99C 'object':35B,81C 'other':95C 'privileg':51B,101C 'read':7A,59B,109C 'record':70B,122C 'refer':36B,82C 'request':63B,113C 'self':26B 'self-host':25B 'sequenti':55B,105C 'submit':115C 'user':5A,9A,52B,61B,93C,111C 'view':94C 'vulner':83C 'workflow':10A,28B,39B,96C 'yet':14A 'zr.admin.net':1A,21A,29B,30B,71C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Zr.Admin.NET that include the commit range 85cff6a through eb9228a are exposed, with the workflow module in use. The attacker needs a valid login, but any authenticated user can reach the endpoint. Teams running later commits or not using the workflow module can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zradminnet"],"ptokens":["admin","net","zr"],"labels":["dotnet","high","idor","other","selfhosted","workflow","zradminnet"],"campaign_type":null,"search_a":"'-129454':17A,20A '-2026':16A,19A 'cve':15A,18A 'fix':13A 'instanc':11A 'log':3A 'logged-in':2A 'read':7A 'user':5A,9A 'workflow':10A 'yet':14A 'zr.admin.net':1A,21A","search_b":"'/workflow/instance':43B 'applic':66B 'approv':62B,69B 'content':65B 'detail':67B 'direct':34B 'dotnet':22B 'endpoint':41B 'enumer':54B 'form':64B 'get':42B 'host':27B 'id':57B 'idor':23B 'insecur':33B 'instanc':40B,56B 'instanceid':44B 'log':47B 'logged-in':46B 'low':50B 'low-privileg':49B 'object':35B 'privileg':51B 'read':59B 'record':70B 'refer':36B 'request':63B 'self':26B 'self-host':25B 'sequenti':55B 'user':52B,61B 'workflow':28B,39B 'zr.admin.net':29B,30B","search_c":"'/workflow/instance':86C '85cff6a':73C 'applic':118C 'approv':112C,121C 'attack':102C 'authent':98C 'commit':72C,75C 'contain':77C 'content':117C 'detail':119C 'direct':80C 'eb9228a':76C 'enumer':104C 'form':116C 'get':85C 'id':107C 'includ':114C 'insecur':79C 'instanc':97C,106C 'instanceid':87C 'let':89C 'log':91C 'logged-in':90C 'low':100C 'low-privileg':99C 'object':81C 'other':95C 'privileg':101C 'read':109C 'record':122C 'refer':82C 'request':113C 'sequenti':105C 'submit':115C 'user':93C,111C 'view':94C 'vulner':83C 'workflow':96C 'zr.admin.net':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129454","severity":null,"published_at":"2026-11-15T02:17:21+00:00","modified_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129454:4016","url":null,"severity":null,"published_at":"2026-11-15T02:36:48+00:00","modified_at":"2026-11-15T02:36:48+00:00","first_seen_at":"2026-11-15T02:36:48+00:00","fetched_at":"2026-11-15T02:36:48+00:00","note":"VulnCheck advisory + issue #27 (open, no maintainer reply). Commit 85cff6a is the START of affected range (workflow permission change, 2026-08-01), not a fix; no fix found."}],"documents":[{"id":160176,"url":"https://github.com/izhaorui/Zr.Admin.NET/commit/85cff6ae22389c241d3a4efe178273966650f7ca","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":160177,"url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-85cff6a-through-eb9228a-idor-via-workflow-instance-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}