Insecure Direct Object Reference in Zr.Admin.NET
CVE-2026-129455

5.3MEDIUM

Key Information:

Vendor

Izhaorui

Status
Zr.admin.net
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129455?

The Zr.Admin.NET application has a vulnerability within the FrontArticleController that allows authenticated users to alter article visibility settings of other users through insecure direct object reference. An attacker can exploit this by sending a PUT request to the /front/article/changePublic endpoint, including their own UserId in the request body. This action can modify the state of private articles to public, thereby granting them unauthorized access to read these articles anonymously via a subsequent GET request for the specific article ID.

Affected Version(s)

Zr.Admin.NET e6ceaf47548f1a485f3ba3f4c139905e90fee0a2

References

https://vul.yulun.ac.cn/20261114/zr-admin-net/
third-party-advisory
https://github.com/izhaorui/Zr.Admin.NET/issues/27
issue-tracking
https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a2301...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.