ZR.ADMIN.NET · CVE-2026-129455 · Package
NO FIX YET
Zr.Admin.NET's FrontArticleController trusts a user ID sent in the request body, so any logged-in user can change other users' article visibility and pin state. An attacker can make private articles public and then read them without logging in.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Zr.Admin.NET from the affected commit range that expose the front-end article feature to logged-in users. The flaw requires a valid account, but any account holder can reach other users' private articles. Deployments that do not use the front article feature or that run a different version can skip it.
Not affected if different-version, no-user-accounts
Who cares dotnet, self-hosted, zr-admin-net
e6ceaf4 and eb9228aPUT /front/article/changePublic endpoint in your code or web server logsNo fix yet, per the sources.
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.