Missing Authorization Vulnerability in Zr.Admin.NET by izhaorui
CVE-2026-129466

5.3MEDIUM

Key Information:

Vendor

Izhaorui

Status
Zr.admin.net
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129466?

The Zr.Admin.NET platform has a missing authorization flaw in the TasksController.Get method that permits any authenticated user to access confidential details of scheduled tasks without the necessary monitor:job permission. Attackers can exploit this vulnerability to extract task IDs from the unsecured /monitor/jobLog/list endpoint, enabling them to obtain sensitive information such as job parameters, API URLs, cron expressions, and stored SQL statements, potentially compromising the integrity of the system.

Affected Version(s)

Zr.Admin.NET 1845017b67b3de3d12fad0238f5493235f70a93d

References

https://vul.yulun.ac.cn/20261114/zr-admin-net/
third-party-advisory
https://github.com/izhaorui/Zr.Admin.NET/issues/27
issue-tracking
https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a2301...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.