CVE-2026-129454
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Zr.Admin.NET Workflow Instances

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129454

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
izhaorui zr.admin.net From commit_85cff6a (inc) to commit_eb9228a (inc)
izhaorui zr.admin.net From commit_0ee1ab8a (inc) to commit_eb9228a2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129454 is an Insecure Direct Object Reference (IDOR) vulnerability in Zr.Admin.NET. It exists in the GET /workflow/instance/{instanceId} endpoint, allowing authenticated low-privilege users to access other users' workflow instances by guessing sequential instance IDs. This exposes sensitive data like approval requests, form contents, applicant details, and approval records.

Detection Guidance

To detect this IDOR vulnerability, monitor HTTP GET requests to /workflow/instance/{instanceId} endpoints. Check for sequential instance ID enumeration attempts by low-privilege users. Inspect logs for unauthorized access to workflow data such as approval requests or applicant details. Test with authenticated user accounts to verify if they can access other users' workflow instances.

Impact Analysis

An attacker with low privileges could enumerate workflow IDs to view others' sensitive workflow data, including approval requests and applicant information. This could lead to unauthorized access to confidential business processes, data leaks, or potential misuse of exposed information.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by leaking protected health information. It undermines data confidentiality requirements, potentially leading to regulatory penalties, loss of trust, and legal consequences for affected organizations.

Mitigation Strategies

Immediately update Zr.Admin.NET to a version beyond commit eb9228a. Implement strict role-based access control for workflow instance endpoints. Validate and sanitize all user-supplied input in file download endpoints to prevent path traversal. Review and restrict permissions for the 'common' filter to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129454. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...