Insecure Direct Object Reference Vulnerability in Zr.Admin.NET by izhaorui

CVE-2026-129465

What is CVE-2026-129465?

The Zr.Admin.NET platform is vulnerable to an insecure direct object reference in its SysProfileController.UpdateProfile method. This flaw allows authenticated users to change the user profiles of other accounts via manipulation of the UserId parameter. By leveraging this vulnerability, an attacker could alter administrative details, such as changing the administrator's phone number to one under their control. Following this, they can exploit the vulnerability further to request an SMS verification code and gain unauthorized access to the administrator's account through a phone login. Immediate action is recommended to mitigate the associated risks.

References