{"id":"CVE-2026-129455","kind":"vulnerability","aliases":["CVE-2026-129455"],"related":[],"title":"Zr.Admin.NET: authenticated users can change other users' article visibility","description":"Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.","summary":"Zr.Admin.NET's FrontArticleController trusts a user ID sent in the request body, so any logged-in user can change other users' article visibility and pin state. An attacker can make private articles public and then read them without logging in.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zr.Admin.NET","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotnet","package","self-hosted","zr-admin-net"],"not_affected_if":["different-version","no-user-accounts"],"how_to_check":"- Check whether your deployment runs Zr.Admin.NET built from commits between `e6ceaf4` and `eb9228a`\n- Look for the `PUT /front/article/changePublic` endpoint in your code or web server logs","fix":null,"status":"open","published_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:27+00:00","updated_at":"2026-11-15T02:36:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T02:36:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zr.Admin.NET: authenticated users can change other users' article visibility","impact":"medium","summary":"Zr.Admin.NET's FrontArticleController trusts a user ID sent in the request body, so any logged-in user can change other users' article visibility and pin state. An attacker can make private articles public and then read them without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zr-admin-net","dotnet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Private articles of other users become public and readable anonymously","analyst_note":"Find the fixed commit or release from the vendor repository and the vulncheck advisory; the sources give no fixed version.","how_to_check":"- Check whether your deployment runs Zr.Admin.NET built from commits between `e6ceaf4` and `eb9228a`\n- Look for the `PUT /front/article/changePublic` endpoint in your code or web server logs\n- unknown for anything beyond this","plain_action":"","product_name":"Zr.Admin.NET","needs_analyst":true,"not_affected_if":["no-user-accounts","different-version"],"who_is_affected":"Teams running Zr.Admin.NET from the affected commit range that expose the front-end article feature to logged-in users. The flaw requires a valid account, but any account holder can reach other users' private articles. Deployments that do not use the front article feature or that run a different version can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4610,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129455':12A,15A '-2026':11A,14A '/front/article':117C '/front/article/changepublic':98C 'admin':24B 'allow':82C 'anonym':114C 'articl':8A,48B,58B,89C,109C 'attack':54B,94C 'authent':2A,83C 'bodi':37B,105C 'chang':5A,45B,86C 'commit':67C,70C 'contain':72C 'cve':10A,13A 'direct':75C 'dotnet':17B 'e6ceaf4':68C 'eb9228a':71C 'frontarticlecontrol':28B,80C 'get':116C 'host':21B 'id':32B,118C 'insecur':74C 'log':41B,65B 'logged-in':40B 'make':56B,107C 'net':25B 'object':76C 'packag':18B 'pin':51B,92C 'privat':57B,108C 'public':59B,110C 'put':97C 'read':62B,112C 'refer':77C 'request':36B 'self':20B 'self-host':19B 'send':96C 'sent':33B 'state':52B,93C 'trust':29B 'user':3A,7A,31B,43B,47B,84C,88C 'userid':102C 'via':115C 'visibl':9A,49B,90C 'vulner':78C 'without':64B 'zr':23B 'zr-admin-net':22B 'zr.admin.net':1A,16A,26B,66C","nicknames":[],"mitigations":[],"who_affected":"Teams running Zr.Admin.NET from the affected commit range that expose the front-end article feature to logged-in users. The flaw requires a valid account, but any account holder can reach other users' private articles. Deployments that do not use the front article feature or that run a different version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zradminnet"],"ptokens":["admin","net","zr"],"labels":["dotnet","medium","package","selfhosted","vendor","zradminnet"],"campaign_type":null,"search_a":"'-129455':12A,15A '-2026':11A,14A 'articl':8A 'authent':2A 'chang':5A 'cve':10A,13A 'user':3A,7A 'visibl':9A 'zr.admin.net':1A,16A","search_b":"'admin':24B 'articl':48B,58B 'attack':54B 'bodi':37B 'chang':45B 'dotnet':17B 'frontarticlecontrol':28B 'host':21B 'id':32B 'log':41B,65B 'logged-in':40B 'make':56B 'net':25B 'packag':18B 'pin':51B 'privat':57B 'public':59B 'read':62B 'request':36B 'self':20B 'self-host':19B 'sent':33B 'state':52B 'trust':29B 'user':31B,43B,47B 'visibl':49B 'without':64B 'zr':23B 'zr-admin-net':22B 'zr.admin.net':26B","search_c":"'/front/article':117C '/front/article/changepublic':98C 'allow':82C 'anonym':114C 'articl':89C,109C 'attack':94C 'authent':83C 'bodi':105C 'chang':86C 'commit':67C,70C 'contain':72C 'direct':75C 'e6ceaf4':68C 'eb9228a':71C 'frontarticlecontrol':80C 'get':116C 'id':118C 'insecur':74C 'make':107C 'object':76C 'pin':92C 'privat':108C 'public':110C 'put':97C 'read':112C 'refer':77C 'send':96C 'state':93C 'user':84C,88C 'userid':102C 'via':115C 'visibl':90C 'vulner':78C 'zr.admin.net':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129455","severity":null,"published_at":"2026-11-15T02:17:21+00:00","modified_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null}],"documents":[{"id":160178,"url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-e6ceaf4-through-eb9228a-idor-via-front-article-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}