Description
Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| izhaorui | Zr.Admin.NET | — | — |
References
- https://vul.yulun.ac.cn/20261114/zr-admin-net/ third-party-advisory
- https://github.com/izhaorui/Zr.Admin.NET/issues/27 issue-tracking
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Controllers/WfFlowInstanceController.cs#L49-L57 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Service/WfFlowInstanceService.cs#L173-L176 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/commit/85cff6ae22389c241d3a4efe178273966650f7ca technical-description patch
- VulnCheck Advisory: Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint third-party-advisory