---
id: "CVE-2026-129465"
page: "https://infrastack.ai/live/CVE-2026-129465"
kind: "vulnerability"
aliases: ["CVE-2026-129465"]
title: "Zr.Admin.NET: any logged-in user can take over the administrator account"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "self-hosted", "zr-admin-net"]
not_affected_if: ["commit-outside-range", "profile-endpoint-restricted"]
published_at: "2026-11-15T02:17:21+00:00"
first_seen_at: "2026-11-15T02:35:07+00:00"
updated_at: "2026-11-15T02:36:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129465", "first_seen_at": "2026-11-15T02:35:07+00:00"}]
exploit_sources: []
---

# Zr.Admin.NET: any logged-in user can take over the administrator account

Link for people: https://infrastack.ai/live/CVE-2026-129465 (this .md is for agents)

Zr.Admin.NET's profile update endpoint, SysProfileController.UpdateProfile, trusts a UserId value from the request, so any authenticated user can change other accounts' profiles. An attacker can set the administrator's phone number to one they control and log in as the administrator through the phone login flow.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project's source is between commit `af07ffc` and commit `eb9228a` (inclusive) in the Zr.Admin.NET repository.
- Look at `SysProfileController.UpdateProfile` to see whether it uses the UserId from the request instead of the logged-in user's identity.
- Confirm whether the `/PhoneLogin` and `/checkMobile` endpoints are enabled.

## Fix

- Zr.Admin.NET: a patch is linked from the advisory sources (github.com); the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-15T02:35:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129465

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zr-admin-net-commit-af07ffc-through-eb9228a-idor-via-system-user-profile
- [fix] Patch: github.com https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399

## From the sources

Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_