CVE-2026-129465

Name of the Vulnerable Software and Affected Versions Zr.Admin.NET versions af07ffc through eb9228a

Description An insecure direct object reference exists in the UpdateProfile function of the SysProfileController. This allows an authenticated user to modify other accounts by manipulating the UserId variable. An attacker can change an administrator's phone number to one they control, request an SMS code via the '/checkMobile' endpoint, and subsequently use the '/PhoneLogin' endpoint to take over the administrator account.

Recommendations Update Zr.Admin.NET to a version beyond commit eb9228a. As a temporary mitigation, restrict access to the UpdateProfile function in the SysProfileController to prevent unauthorized modification of the UserId variable.