ZR.ADMIN.NET · CVE-2026-129466 · Package
NO FIX YET
Zr.Admin.NET has a missing authorization check in TasksController.Get, so any logged-in user can read scheduled task details without the monitor:job permission. An attacker can list task ids from the unprotected /monitor/jobLog/list endpoint and read job parameters, API URLs, cron expressions and stored SQL statements.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of Zr.Admin.NET built from the affected commit range, where an ordinary logged-in account can reach the scheduled task pages. Deployments that restrict accounts to users holding the monitor:job permission are not exposed through this path. The sources do not say whether a fixed version exists.
Not affected if default-config
Who cares dotnet, self-hosted, zr-admin-net
git log --oneline 1845017..eb9228a in the project repository)/monitor/jobLog/list and get task dataNo fix yet, per the sources.
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.