---
id: "CVE-2026-129455"
page: "https://infrastack.ai/live/CVE-2026-129455"
kind: "vulnerability"
aliases: ["CVE-2026-129455"]
title: "Zr.Admin.NET: authenticated users can change other users' article visibility"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Zr.Admin.NET", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dotnet", "package", "self-hosted", "zr-admin-net"]
not_affected_if: ["different-version", "no-user-accounts"]
published_at: "2026-11-15T02:17:21+00:00"
first_seen_at: "2026-11-15T02:35:07+00:00"
updated_at: "2026-11-15T02:36:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129455", "first_seen_at": "2026-11-15T02:35:07+00:00"}]
exploit_sources: []
---

# Zr.Admin.NET: authenticated users can change other users' article visibility

Link for people: https://infrastack.ai/live/CVE-2026-129455 (this .md is for agents)

Zr.Admin.NET's FrontArticleController trusts a user ID sent in the request body, so any logged-in user can change other users' article visibility and pin state. An attacker can make private articles public and then read them without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zr.Admin.NET affected range not listed fixed no fixed version listed

## How to check

- Check whether your deployment runs Zr.Admin.NET built from commits between `e6ceaf4` and `eb9228a`
- Look for the `PUT /front/article/changePublic` endpoint in your code or web server logs

## Timeline

- 2026-11-15T02:35:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129455

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zr-admin-net-commit-e6ceaf4-through-eb9228a-idor-via-front-article-api

## From the sources

Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_