{"id":"CVE-2026-129465","kind":"vulnerability","aliases":["CVE-2026-129465"],"related":[],"title":"Zr.Admin.NET: any logged-in user can take over the administrator account","description":"Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.","summary":"Zr.Admin.NET's profile update endpoint, SysProfileController.UpdateProfile, trusts a UserId value from the request, so any authenticated user can change other accounts' profiles. An attacker can set the administrator's phone number to one they control and log in as the administrator through the phone login flow.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","self-hosted","zr-admin-net"],"not_affected_if":["commit-outside-range","profile-endpoint-restricted"],"how_to_check":"- Check whether the project's source is between commit `af07ffc` and commit `eb9228a` (inclusive) in the Zr.Admin.NET repository.\n- Look at `SysProfileController.UpdateProfile` to see whether it uses the UserId from the request instead of the logged-in user's identity.\n- Confirm whether the `/PhoneLogin` and `/checkMobile` endpoints are enabled.","fix":"- Zr.Admin.NET: a patch is linked from the advisory sources (github.com); the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:27+00:00","updated_at":"2026-11-15T02:36:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T02:36:27Z","model":"claude-haiku-5-5","output":{"fix":"- Zr.Admin.NET: a patch is linked from the advisory sources (github.com); the exact fixed version is unknown from the sources.","reach":"internet","title":"Zr.Admin.NET: any logged-in user can take over the administrator account","impact":"high","summary":"Zr.Admin.NET's profile update endpoint, SysProfileController.UpdateProfile, trusts a UserId value from the request, so any authenticated user can change other accounts' profiles. An attacker can set the administrator's phone number to one they control and log in as the administrator through the phone login flow.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zr-admin-net","dotnet","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker takes over the administrator account and its admin rights","analyst_note":"Confirm the exact fixed commit or release from the linked GitHub patch and check whether /PhoneLogin is enabled by default.","how_to_check":"- Check whether the project's source is between commit `af07ffc` and commit `eb9228a` (inclusive) in the Zr.Admin.NET repository.\n- Look at `SysProfileController.UpdateProfile` to see whether it uses the UserId from the request instead of the logged-in user's identity.\n- Confirm whether the `/PhoneLogin` and `/checkMobile` endpoints are enabled.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["commit-outside-range","profile-endpoint-restricted"],"who_is_affected":"Teams that run Zr.Admin.NET built from commits in the affected range, where any logged-in account can reach the profile update endpoint. Deployments on a release or commit outside the range, or with the profile update endpoint otherwise restricted, are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4623,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129465':15A,18A '-2026':14A,17A '/checkmobile':117C '/phonelogin':122C 'account':12A,48B,97C,128C 'admin':26B 'administr':11A,55B,68B,104C,127C 'af07ffc':76C 'allow':90C 'attack':51B,100C 'authent':43B,92C 'chang':46B 'code':115C 'commit':75C,78C 'contain':80C 'control':62B,111C 'cve':13A,16A 'direct':83C 'dotnet':19B 'eb9228a':79C 'endpoint':32B 'flow':73B 'host':23B 'insecur':82C 'log':4A,64B,119C 'logged-in':3A 'login':72B 'modifi':95C 'net':27B 'number':58B,107C 'object':84C 'one':60B,109C 'packag':20B 'phone':57B,71B,106C 'profil':30B,49B 'refer':85C 'request':40B,112C 'self':22B 'self-host':21B 'set':53B,102C 'sms':114C 'sysprofilecontroller.updateprofile':33B,88C 'take':8A,124C 'trust':34B 'updat':31B 'user':6A,44B,93C 'userid':36B,99C 'valu':37B 'via':98C,116C 'vulner':86C 'zr':25B 'zr-admin-net':24B 'zr.admin.net':1A,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Zr.Admin.NET built from commits in the affected range, where any logged-in account can reach the profile update endpoint. Deployments on a release or commit outside the range, or with the profile update endpoint otherwise restricted, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","selfhosted","zradminnet"],"campaign_type":null,"search_a":"'-129465':15A,18A '-2026':14A,17A 'account':12A 'administr':11A 'cve':13A,16A 'log':4A 'logged-in':3A 'take':8A 'user':6A 'zr.admin.net':1A","search_b":"'account':48B 'admin':26B 'administr':55B,68B 'attack':51B 'authent':43B 'chang':46B 'control':62B 'dotnet':19B 'endpoint':32B 'flow':73B 'host':23B 'log':64B 'login':72B 'net':27B 'number':58B 'one':60B 'packag':20B 'phone':57B,71B 'profil':30B,49B 'request':40B 'self':22B 'self-host':21B 'set':53B 'sysprofilecontroller.updateprofile':33B 'trust':34B 'updat':31B 'user':44B 'userid':36B 'valu':37B 'zr':25B 'zr-admin-net':24B 'zr.admin.net':28B","search_c":"'/checkmobile':117C '/phonelogin':122C 'account':97C,128C 'administr':104C,127C 'af07ffc':76C 'allow':90C 'attack':100C 'authent':92C 'code':115C 'commit':75C,78C 'contain':80C 'control':111C 'direct':83C 'eb9228a':79C 'insecur':82C 'log':119C 'modifi':95C 'number':107C 'object':84C 'one':109C 'phone':106C 'refer':85C 'request':112C 'set':102C 'sms':114C 'sysprofilecontroller.updateprofile':88C 'take':124C 'user':93C 'userid':99C 'via':98C,116C 'vulner':86C 'zr.admin.net':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129465","severity":null,"published_at":"2026-11-15T02:17:21+00:00","modified_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null}],"documents":[{"id":160181,"url":"https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":160182,"url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-af07ffc-through-eb9228a-idor-via-system-user-profile","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}