CVE-2026-129465
Deferred Deferred - Pending Action

Authenticated User Privilege Escalation in Zr.Admin.NET

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
izhaorui zr.admin.net *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129465 is an Insecure Direct Object Reference (IDOR) vulnerability in Zr.Admin.NET. It allows any authenticated user to modify other accounts by exploiting the SysProfileController.UpdateProfile endpoint. Attackers can change an administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.

Detection Guidance

Check Zr.Admin.NET versions between commits af07ffc and eb9228a for the SysProfileController.UpdateProfile endpoint. Monitor logs for unauthorized profile modifications or SMS verification requests from non-admin users. Inspect SysUserService for improper UserId parameter handling.

Impact Analysis

This vulnerability allows attackers to gain full administrative access to the system. They can take over administrator accounts, modify sensitive data, and perform unauthorized actions. The impact includes loss of data confidentiality, integrity, and system availability.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access and potential data breaches. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful attack could result in unauthorized data exposure, violating these regulations.

Mitigation Strategies

Upgrade Zr.Admin.NET to versions beyond commit eb9228a. Implement strict input validation for UserId parameters in profile updates. Disable SMS-based admin login if possible. Review and restrict SysProfileController permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...