{"id":"CVE-2026-129466","kind":"vulnerability","aliases":["CVE-2026-129466"],"related":[],"title":"Zr.Admin.NET: logged-in users can read scheduled task details without permission","description":"Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.","summary":"Zr.Admin.NET has a missing authorization check in TasksController.Get, so any logged-in user can read scheduled task details without the monitor:job permission. An attacker can list task ids from the unprotected /monitor/jobLog/list endpoint and read job parameters, API URLs, cron expressions and stored SQL statements.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zr.Admin.NET","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotnet","package","self-hosted","zr-admin-net"],"not_affected_if":["default-config"],"how_to_check":"- Check whether your deployment includes Zr.Admin.NET commits between 1845017 and eb9228a (`git log --oneline 1845017..eb9228a` in the project repository)\n- Test whether a non-admin logged-in account can call `/monitor/jobLog/list` and get task data","fix":null,"status":"open","published_at":"2026-11-15T02:17:21+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","triaged_at":"2026-11-15T02:36:31+00:00","updated_at":"2026-11-15T02:36:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T02:36:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zr.Admin.NET: logged-in users can read scheduled task details without permission","impact":"low","summary":"Zr.Admin.NET has a missing authorization check in TasksController.Get, so any logged-in user can read scheduled task details without the monitor:job permission. An attacker can list task ids from the unprotected /monitor/jobLog/list endpoint and read job parameters, API URLs, cron expressions and stored SQL statements.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zr-admin-net","dotnet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Logged-in user reads stored SQL statements and job API URLs","analyst_note":"Confirm the fixed commit or version and whether a patch exists; check the vulncheck advisory for details.","how_to_check":"- Check whether your deployment includes Zr.Admin.NET commits between 1845017 and eb9228a (`git log --oneline 1845017..eb9228a` in the project repository)\n- Test whether a non-admin logged-in account can call `/monitor/jobLog/list` and get task data\n- unknown","plain_action":"","product_name":"Zr.Admin.NET","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Any deployment of Zr.Admin.NET built from the affected commit range, where an ordinary logged-in account can reach the scheduled task pages. Deployments that restrict accounts to users holding the monitor:job permission are not exposed through this path. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4612,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129466':15A,18A '-2026':14A,17A '/monitor/joblog/list':62B,114C '1845017':78C 'admin':27B 'allow':90C 'api':68B,120C 'attack':54B,106C 'author':33B,85C 'check':34B 'commit':77C,80C 'contain':82C 'cron':70B,122C 'cve':13A,16A 'detail':10A,47B,100C 'dotnet':20B 'eb9228a':81C 'endpoint':63B,115C 'express':71B,123C 'host':24B 'id':58B,110C 'job':51B,66B,104C,118C 'list':56B 'log':3A,40B,93C 'logged-in':2A,39B,92C 'miss':32B,84C 'monitor':50B,103C 'net':28B 'obtain':108C 'packag':21B 'paramet':67B,119C 'permiss':12A,52B,105C 'read':7A,44B,65B,97C 'retriev':117C 'schedul':8A,45B,98C 'self':23B 'self-host':22B 'sql':74B,126C 'statement':75B,127C 'store':73B,125C 'task':9A,46B,57B,99C,109C 'taskscontroller.get':36B,88C 'unprotect':61B,113C 'url':69B,121C 'user':5A,42B,95C 'vulner':86C 'without':11A,48B,101C 'zr':26B 'zr-admin-net':25B 'zr.admin.net':1A,19A,29B,76C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Zr.Admin.NET built from the affected commit range, where an ordinary logged-in account can reach the scheduled task pages. Deployments that restrict accounts to users holding the monitor:job permission are not exposed through this path. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["zradminnet"],"ptokens":["admin","net","zr"],"labels":["dotnet","medium","package","selfhosted","vendor","zradminnet"],"campaign_type":null,"search_a":"'-129466':15A,18A '-2026':14A,17A 'cve':13A,16A 'detail':10A 'log':3A 'logged-in':2A 'permiss':12A 'read':7A 'schedul':8A 'task':9A 'user':5A 'without':11A 'zr.admin.net':1A,19A","search_b":"'/monitor/joblog/list':62B 'admin':27B 'api':68B 'attack':54B 'author':33B 'check':34B 'cron':70B 'detail':47B 'dotnet':20B 'endpoint':63B 'express':71B 'host':24B 'id':58B 'job':51B,66B 'list':56B 'log':40B 'logged-in':39B 'miss':32B 'monitor':50B 'net':28B 'packag':21B 'paramet':67B 'permiss':52B 'read':44B,65B 'schedul':45B 'self':23B 'self-host':22B 'sql':74B 'statement':75B 'store':73B 'task':46B,57B 'taskscontroller.get':36B 'unprotect':61B 'url':69B 'user':42B 'without':48B 'zr':26B 'zr-admin-net':25B 'zr.admin.net':29B","search_c":"'/monitor/joblog/list':114C '1845017':78C 'allow':90C 'api':120C 'attack':106C 'author':85C 'commit':77C,80C 'contain':82C 'cron':122C 'detail':100C 'eb9228a':81C 'endpoint':115C 'express':123C 'id':110C 'job':104C,118C 'log':93C 'logged-in':92C 'miss':84C 'monitor':103C 'obtain':108C 'paramet':119C 'permiss':105C 'read':97C 'retriev':117C 'schedul':98C 'sql':126C 'statement':127C 'store':125C 'task':99C,109C 'taskscontroller.get':88C 'unprotect':113C 'url':121C 'user':95C 'vulner':86C 'without':101C 'zr.admin.net':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T02:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129466","severity":null,"published_at":"2026-11-15T02:17:21+00:00","modified_at":"2026-11-15T02:17:22+00:00","first_seen_at":"2026-11-15T02:35:07+00:00","fetched_at":"2026-11-15T02:35:07+00:00","note":null}],"documents":[{"id":160183,"url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-1845017-through-eb9228a-missing-authorization-via-system-tasks-get","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}