CVE-2026-129454

Name of the Vulnerable Software and Affected Versions Zr.Admin.NET versions 85cff6a through eb9228a

Description An insecure direct object reference exists in the 'GET /workflow/instance/{instanceId}' endpoint. This allows authenticated users with low privileges to view workflow instances belonging to other users by enumerating sequential instanceId values. This can lead to the unauthorized disclosure of approval requests, including applicant details, submitted form contents, and approval records.

Recommendations Update Zr.Admin.NET to a version beyond commit eb9228a. As a temporary mitigation, restrict access to the 'GET /workflow/instance/{instanceId}' endpoint to prevent unauthorized enumeration of the instanceId variable.