EUVD-2026-125958

Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/instanceId that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other...

CVE-2026-129454

The Zr.Admin.NET project (commits 85cff6a through eb9228a) contains an Insecure Direct Object Reference (IDOR) vulnerability in the GET /workflow/instance/{instanceId} endpoint. This flaw allows authenticated low-privilege attackers to bypass authorization by enumerating sequential instance IDs. ...

PT-2026-147445

Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/instanceId that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other...