CVE-2026-129466
Deferred Deferred - Pending Action

Missing Authorization in Zr.Admin.NET TasksController

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129466

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authorization vulnerability in Zr.Admin.NET where the TasksController.Get endpoint fails to check for the required monitor:job permission. Any logged-in user can access scheduled task details without proper authorization. Attackers can first retrieve task IDs from the unprotected /monitor/jobLog/list endpoint and then use those IDs to access sensitive information like job parameters, API URLs, cron expressions, and stored SQL statements.

Detection Guidance

Check if the /monitor/jobLog/list endpoint is accessible without authentication. Use curl to test: curl -k https://<target>/monitor/jobLog/list. If it returns task IDs, the system may be vulnerable. Inspect TasksController.Get endpoint for missing permission checks.

Impact Analysis

An attacker with access to the system could exploit this to read sensitive task configurations and data, potentially leading to unauthorized access to system functions, data leaks, or further exploitation of the application's features. The impact includes exposure of internal API endpoints, database queries, and scheduled job details.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of stored SQL statements or API URLs might also breach data integrity and access control principles required by these regulations.

Mitigation Strategies

Apply the latest patches to Zr.Admin.NET. Ensure proper authorization checks are enforced in TasksController.Get. Restrict access to /monitor/jobLog/list endpoint. Review and update user permissions to require monitor:job for task access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...